Stalkerware: the spyware installed by someone who knows the passcode

What the word means

The Coalition Against Stalkerware defines stalkerware as software that lets a remote user monitor a device "without that user’s consent and without explicit, persistent notification"[S1]. Its guidance lists hiding behaviors such as a concealed icon and resistance to uninstalling. The definition draws a line on purpose: parental-control and anti-theft apps that work openly are a separate, dual-use category, and mercenary spyware sold to governments is a different one again[S1]. The distinction is consent and notice, not the technology.

Counting what hides

Counting is hard because the product is built to hide. The strongest public numbers come from one security vendor’s users and are floors by construction.

Kaspersky’s yearly series shows the shape of the problem: affected users fell from a high in 2019 and have since stayed within a narrow range[S3]. The decline may reflect fewer infections, changed detection or a changed user base; the data cannot say which. Its May 2026 release reports a combined figure for 2024 and 2025, a multi-year total, newly seen families and users across well over a hundred countries[S2]. Kaspersky does not split the latest figure by year, so it cannot be set directly against the single-year counts of earlier reports. The figures are unique users of its products whose apps flagged stalkerware, a floor and not a rate.

The survey in the same release found that a minority of respondents reported digital stalking[S2]. The Lab treats that as a signal about how common the experience is, not as a measure of how many phones carry stalkerware.

The trade that leaks

The industry that sells stalkerware has a poor record of protecting its own records. TechCrunch’s running tally lists 27 stalkerware-type companies that were hacked or leaked data since 2017; eight shut down and four were breached more than once[S4].

Two cases show what exposure looks like. In 2025, a researcher found an unauthenticated interface at one vendor that exposed more than 62,000 customer email addresses with plaintext passwords and device data from about 26,000 victims[S6]. Google added Play Protect alerts afterward, and the service reappeared on another host[S6]. In February 2026 a hacktivist scraped about 536,000 purchase records belonging to a company behind several monitoring apps: customer email, product bought and amount, with no dates. TechCrunch authenticated a sample, found it held purchaser data rather than victims’ surveillance content, and says the vendor did not respond[S5].

That data belongs to victims and customers, and the Lab does not use it. A purchaser list can name people who are innocent or lawful parents, and searching another person’s address outside lawful process is not something this article recommends.

Three ways in

Not every case involves an installed app. Figure 2 sorts the routes the sources describe.

The first is an app installed on the phone. AV-Comparatives tested 13 security products against 17 sideloaded stalkerware test cases on a Samsung phone running Android 15, simulating steps such as allowing installs from unknown sources, granting device-administrator rights and hiding the icon[S7]. All of those are settings changes made on the handset itself.

The second is the account. SecureMac, summarizing research by Citizen Lab, says iPhone stalkerware commonly works without jailbreaking, by using the victim’s iCloud credentials to download backups repeatedly[S8]. We have not read the Citizen Lab original, so we attribute the point and no more. If it holds, the evidence sits in the account (devices listed, trusted phone numbers, recovery contacts) as much as on the phone.

The third is a tracker placed in belongings. Trackers are not malware, and Google notes that switching off Bluetooth or location on the victim’s phone does not stop one from reporting, so the tracker itself must be found and disabled[S9].

Our assessment: ordinary clues, read together

The Lab’s reading of these sources is that stalkerware rarely announces itself and rarely needs sophistication, so the evidence is mundane: an app the owner does not recognize, access with no related purpose, a configuration profile nobody remembers, a sign-in from an unfamiliar device. None of these establishes anything alone. A careful report says which clues came from the phone and which from an account, because the remedy and the safety risk differ. It also states the period the evidence covers, because an app removed last month and an app running today call for different conclusions.

The second part of the assessment concerns numbers. Stalkerware statistics are easy to quote and hard to use. A vendor count, a survey percentage and a breach tally measure three different things, and none is a rate for the general public. The Lab uses them to show that the problem is persistent and that its sellers are careless with data, and for nothing more.

Safety comes before removal

The AV-Comparatives test found that most alerts from security products advised immediate uninstalling without warning that doing so could alert whoever installed the app, and none used a secure notification channel[S7]. Removal is therefore not the first step. For anyone who suspects stalkerware, the Lab’s advice, consistent with that finding, is safety planning with a domestic-violence advocate before the phone changes in any way. Changing a password on a compromised device may also alert the abuser[S8]. This article gives no removal steps; it is not legal or safety advice.

What the Lab is watching

• Further stalkerware vendor breaches, and whether exposed purchase data is misused.
• Any 2026 release of the Coalition’s or Kaspersky’s own country-by-country counts[S3].
• Platform changes to how owners see sensor use. Apple’s App Privacy Report lists recent camera, microphone, location, photo and contact access but is off by default and covers seven days[S10]. Android 12 and later show a privacy dashboard and a status-bar indicator when the camera or microphone is in use[S11].

What this means for examiners

Examination is consent-based. The device owner decides, and where a case involves protective orders or family-law proceedings, counsel and lawful process decide what is preserved and shared. A client should leave with a statement of what the phone shows and what it cannot, and with a safety plan that exists before any change is made to the phone. Where the client is the one being watched, ask how they prefer to be contacted, because a message to a monitored phone or a shared account may be read by someone else.