TechNews DevTop examines stalkerware: software used by someone close to the victim to monitor a phone in secret. Unlike random malware, it usually arrives through physical access and an unlocked screen. The Coalition Against Stalkerware—a domestic-violence and cybersecurity alliance founded in November 2019—warns that hasty deletion can alert the installer and intensify abuse. Safety planning comes first; technical cleanup second.
- Know the risk: Stalkerware can expose location, messages, photos, calls and searches; installers are usually partners, ex-partners or relatives.
- Check both platforms: verify Android Play Protect and review iPhone iCloud backups plus Safety Check.
- Do not rush deletion: Removing the app can destroy evidence and trigger the abuser; in Spain, call 016 or 112 in immediate danger.
Why stalkerware is different
The technical capability is often modest; context matters. Stalkerware gives covert access to location, messages, photos, calls or searches. The installer generally knows the victim and almost always needs the phone unlocked. That separates it from viruses, trojans, ransomware or ordinary spyware, where the attacker is remote and unknown.
Public data remains partial. Kaspersky’s The State of Stalkerware in 2023–2024, published in March 2024 and described as the most recent edition in the series as of October 2026, recorded 31,031 users worldwide in 2023, up from 29,312 in 2022. In its survey, 12% admitted installing stalkerware or changing settings on a partner’s phone. These figures cover one vendor’s customers.
Warning signs are clues, not proof
Possible signs include rapid battery drain, data spikes, unexplained screen-time increases and unusual notifications. The Coalition says none proves stalkerware is present, and some products run without them. The more reliable signal is behavioral: someone knows phone activity they should not. Document incidents with dates and check shared accounts, location sharing and known passwords; tracking can happen without an app.
How to inspect Android and iPhone
Android: start with Play Protect
Stalkerware is often sideloaded outside the official store, sometimes after protection is disabled. In Google Play Store, tap the profile icon, open Play Protect, then Settings, and confirm ‘Scan apps with Play Protect’ is on. If it is off and you did not disable it, treat that as a warning.
Google Play policy has banned stalkerware since October 1, 2020. Only parental-control and enterprise-management tools are allowed, with a permanent notification and visible icon. Partner surveillance does not qualify, even if known.
Play Protect is imperfect. In an Electronic Frontier Foundation and AV-Comparatives test reported by the Coalition in September 2026, it blocked only 53% of installations, partly because some guides tell users to disable it. Only Malwarebytes detected 100%; others failed against one of the 17 apps tested. A clean scan is not proof.
iPhone: check iCloud and Safety Check
Some iPhone stalkerware does not live on the handset; it reads iCloud backups. If backup is enabled and you did not do it, someone with your Apple password may be involved. Apple’s Safety Check, available on iOS 16 or later, sits under Settings > Privacy & Security > Safety Check and requires two-factor authentication. It reviews access to information and location, linked devices and app permissions, and lets you change the passcode or password. Emergency Reset stops all sharing, while Quick Exit returns home if someone approaches.
What to do, and in what order
Before deletion, the Coalition gives four warnings:
- Removal can be detected. Deleting the app or changing major settings may alert the abuser and increase harassment; act only if safe.
- Make a safety plan with a support organization, using a device the other person cannot access.
- Deletion destroys evidence. If you may report abuse, preserve records first.
- Reinstallation is possible. Use a passcode nobody knows and fast locking, ideally after 30 seconds.
Once safe, a new phone is the Coalition’s safest option. A factory reset is nearly as effective if photos and contacts are backed up. Change passwords, enable two-factor authentication and avoid SMS where possible.
In Spain, the Ministry of Equality’s 016 is free and confidential: phone 016, WhatsApp 600 000 016, email 016-online@igualdad.gob.es and chat. It informs 24 hours a day in 53 languages and gives legal advice from 8:00 to 22:00. INCIBE’s 017 cybersecurity helpline is free, confidential and available daily from 8:00 to 23:00.
Stalkerware is rarely sophisticated; the deeper problem is that defense still asks victims to act as forensic analysts. Android 16 offers tamper-resistant intrusion logging, but only from the moment it is enabled. No tool changes the core fact: the installer had the phone and knows the victim. Protection and support come first; antivirus afterward.