Is someone spying on your Android smartphone? 7 ways to check it

In the digital age, privacy has become a luxury. According to a study Kaspersky 2023, every fifth Android user has at least once encountered suspicions of surveillance through a smartphone. The reasons may be different: from jealousy of loved ones to targeted industrial espionage. But how can you distinguish paranoia from a real threat?

Android, as the most common mobile OS, most often becomes a target for spyware. Unlike iOS, where the installation of third-party software is limited, on Android it is easier to introduce malicious code under the guise of a harmless application. At the same time, surveillance is not always obvious: modern spy utilities can work in the background for years without revealing themselves as high CPU load or pop-up windows.

In this article - practical verification methods, from basic (battery consumption analysis) to advanced (port scanning and root access search). We will also look at which signs indirectly indicate surveillanceeven if the antivirus does not find anything. Important: some steps require technical knowledge - if you are not sure, it is better to contact a specialist.

1. Unexpected consumption of traffic and battery

The first alarm bell is when the smartphone begins to “live its own life.” If the battery runs out within a few hours without active use, and mobile traffic is exhausted within a couple of days, this may indicate background spyware activity.

How to check:

• 📊 Open Settings → Network and Internet → Data transfer → Mobile data usage. See which apps are consuming traffic in the background. It is suspicious if an instant messenger or social network “eats” gigabytes, although you do not use them.
• 🔋 Go to Settings → Battery → Battery usage. Pay attention to applications with high power consumption, especially if their names are unfamiliar to you (for example, System Update Service or Android Accessibility Suite - spies often disguise themselves under such names).
• 📉 Use third-party utilities like AccuBattery or My Data Manager for detailed monitoring. They show not only total consumption, but also activity by time of day.

Important: some legitimate applications (for example, Google Play Services) can also consume a lot of resources. But if there is something like com.android.secureupdate or TestService in the list of top consumers, this is a reason to be wary.

Yes, there were obvious signs|Yes, but I could not confirm|No, but I am afraid that it is possible|No, and I see no reason for surveillance-->

2. Unknown applications and suspicious permissions

Spyware is often disguised as system utilities or updates. For example, a app Cerberus (a popular spy for Android) may be called Android System WebView or Google Play Update. How to find such applications?

Instructions:

1. Open Settings → Applications → All applications.
2. Sort the list by installation date (new ones first). Pay attention to apps that you did not install.
3. Check the permissions of each suspicious application. For example, if a flashlight is asked to access SMS, microphone and geolocation , this is a clear sign of a spy.

Applications with status "Device Administrator" or "Special Access"are especially dangerous. They can block deletion and hide their activity. To find them:

1. Go to Settings → Security → Device Administrators.
2. Disable rights for all unknowns apps.
3. Check the section Settings → Accessibility —some spies use it to intercept input from the screen.

Disable administrator rights|Block Internet access in application settings|Delete application (if possible)|Check device antivirus-->

Disguise example: application Clean Master (a popular “optimizer”) in some versions requested access to SMS and contacts. After the scandal in 2022, it was removed from Google Play, but analogues are still distributed through third-party sources.

3. Strange smartphone behavior

Spyware can manifest itself in unexpected ways. Here are the most common signs:

• 🔊 Spontaneous activation of the microphone or camera. For example, the camera LED lights up without your participation, or noise is heard during a call, as if someone is eavesdropping.
• 📱 The smartphone reboots or turns off for no reason. This may be due to the operation of rootkits (malware with superuser rights).
• 📶 Permanent SMS or calls to short numbers. Some spies send data via premium SMS or calls to paid numbers.
• 🔄 Unusual Google account activity. For example, queries that you did not enter appear in your search history, or routes that you did not travel are displayed in Google Maps routes that you have not traveled are displayed.

To check the activity of the microphone and camera:

1. Install application Access Dots (for Android 12+) - it shows indicators of camera/microphone usage.
2. Check the call log for unknown numbers (especially short or international numbers).
3. Open Settings → Google → Manage Google Account → Security → Recent Activity. Look for suspicious entries or changes.

How do modern spies work?

Most surveillance apps (for example mSpy, FlexiSPY) do not require root access. They disguise themselves as legitimate applications and use Android vulnerabilities to collect data:

- Interception of SMS and calls through accessibility (Accessibility Service).

- Geolocation tracking through Google Location History.

- Stealing passwords from browsers and instant messengers.

- Screenshots of the screen every 5-10 minutes.

Such apps can bypass antiviruses, since their signatures are constantly updated.

4. Checking for root access

If your smartphone has root access (root), and you have them not installed - this is almost a 100% sign of surveillance. Root access allows spyware to:

• Hide itself from antiviruses.
• Modify system files.
• Intercept data from protected applications (for example, banking).

How to check for root access:

1. Install the application Root Checker from Google Play and run the check.
2. If there is a root, but you did not install it, reset your smartphone to factory settings settings via Recovery mode (otherwise the spy may survive a normal reset).
3. Check for applications like SuperSU, Magisk Manager or KingRoot —they control root access.

Critical information: If banking software is installed on a smartphone with root access (Sberbank, Tinkoff, etc.), it must be reinstalled after removing root access. Otherwise, there is a high risk of money theft through modified system libraries.

Symptom	What does this mean	Action
Presence SuperSU or Magisk	root access is installed	Delete via Settings → Applications + reset
File /system/bin/su or /system/xbin/su	Root access activated at the system level	Reflash the smartphone
Applications request root access at startup	Active use of root access	Deny rights + antivirus scan

5. Scan ports and network activity

Spyware often opens network ports to transfer data to the attacker's server. You can check this using special utilities.

Instructions for advanced users:

1. Install Termux from F-Droid (not from Google Play!).
2. Enter the commands:

   pkg update && pkg upgrade
   pkg install net-tools
   netstat -tuln

   This will show all open ports and established connections.

3. Pay attention to suspicious IP addresses (especially from other countries) or ports like 4444, 5555, 8080 —they are often used for remote control.

Alternative method (without Termux):

• 🌐 Use the application Fing to scan the network. It will show all devices connected to your Wi-Fi and open ports.
• 🛡️ Install GlassWire —it visualizes network activity and shows which applications are “calling home.”

Attention: some legitimate applications (for example TeamViewer or AnyDesk) also open ports But if you see. connecting to an IP from China or Russia (if you are not located there) is a cause for concern.

6. Check for keyloggers and spies in instant messengers

Keyloggers (apps that record keystrokes) and spies for WhatsApp/Telegram are one of the most common surveillance tools. They can:

• Intercept. messages.
• Send screenshots of chats.
• Record voice messages.

How to detect:

1. For WhatsApp: open Settings → Storage and dataIf the cache size is disproportionately large (for example, 5 GB during normal use), this may indicate recording software.
2. For all messengers: check if there are any duplicates in the list of installed applications (for example, WhatsApp i WhatsApp Plus). The second is often a modified version with a built-in spy.
3. Use Anti Spy Mobile (from Google Play) to scan for keyloggers.

It is especially dangerous if:

• 🔑 Your messages are read on another device (for example, in WhatsApp Web, although you did not scan the QR code).
• 📤 Messages are sent by themselves or disappear from the chat.
• 🎤 You hear an echo or extraneous noise during calls.

7. Hardware surveillance methods: SIM card and modules

Not all surveillance methods are related to software. There are hardware solutions:

• 📱 SIM cards with firmware: some SIM cards (especially from little-known operators) contain built-in modules for surveillance. They can intercept SMS and. calls even without installing software on the phone.
• 🔌 Spy chargers: devices masquerading as a power bank or charger can copy data when connected.
• 📡 IMEI interceptors: in public places (airports, cafes) false cell towers can be used to intercept traffic.

How to protect yourself:

1. Check the SIM card for suspicious contacts or microcircuits (sometimes they can be seen under a magnifying glass).
2. Never connect your phone to unknown chargers. Use only your own cables and adapters.
3. Disable automatic connection to Wi-Fi networks in Settings → Network and Internet → Wi-Fi → Advanced.
4. Install application SnoopSnitch (requires root access) to detect IMSI traps (false towers).

⚠️ Attention: Hardware surveillance methods are difficult to detect without special equipment. If you suspect targeted surveillance (for example, in a corporate environment or from intelligence agencies), it is better to contact cybersecurity professionals.

What to do if surveillance is confirmed?

If you find signs of spyware, follow the algorithm:

1. Turn off the Internet (airplane mode) - this will interrupt the transfer of data to the attacker.
2. Make a backup copy of important data (photos, contacts) to an external drive. Do not connect it to other devicesuntil you check for viruses.
3. Uninstall suspicious applications and revoke administrative rights.
4. Perform a factory reset:

   Settings → System → Reset settings → Delete all data

   For For reliability, do this through Recovery Mode (press Power + Volume Up when turning on).

5. Install an antivirus (for example, Bitdefender or Kaspersky) and scan the device after resetting.
6. Change all passwords (social networks, mail, banks) from another, clean device.
7. Check the associated accounts (for example, Google or Apple ID) to suspicious activity.

⚠️ Attention: If surveillance is associated with root access or modified firmware, a normal reset will not help. In this case, you need to reflash your smartphone official firmware via Odin (for Samsung), Fastboot (for Google Pixel) or other tools for your model.

If after all the manipulations suspicions remain, consider purchasing a new device. In extreme cases (for example, during a targeted attack), you may need help. cybersecurity specialists.

FAQ: Frequently asked questions about spying on Android

Can I track a spy if I found his IP address?

Theoretically yes, but in practice it is difficult. Most spy apps use proxy servers or VPNs to hide their real IP. figure out, without the help of law enforcement agencies or your provider, you will not be able to find out who it belongs to. In addition, many IP addresses are dynamic and change with each connection.

If you still want to try, use services like IP2Location or WhoisBut do not count on the exact result - often the IP belongs to the hosting provider. in another country.

Can they spy on me via Wi-Fi?

Yes, but this requires special equipment or access to your router Here are the main scenarios:

• If an attacker has connected to your Wi-Fi (for example, knows the password), he can intercept traffic using Wireshark or Bettercap.
• In public networks (cafes, airports) can be used MITM attacks (Man-in-the-Middle), when traffic is redirected through the attacker's server.
• Some routers have vulnerabilities, allowing you to remotely manage them (for example, through a protocol TR-069).

Protection:

• Use VPN (for example, ProtonVPN or NordVPN).
• Disable automatic connection to open networks.
• Update the firmware router and change the Wi-Fi password.

How to monitor your phone without installing apps?

There are several methods that do not require physical access to the device:

1. Through a Google account: if an attacker knows your username and password, he can track your location through Google Maps (Chronology) or read letters c Gmail.
2. Through a telecom operator: some operators (for example, MTS or Beeline) provide “Parental Control” or “Family Sharing” services that allow you to see geolocation and history calls.
3. Through vulnerabilities in the firmware: for example, in 2021, a vulnerability was discovered in chips Qualcomm, allowing users to be tracked without their known.
4. Via Bluetooth or NFC: within a radius of 10–100 meters you can track the device by MAC address (although modern versions of Android randomize it).

Protection:

• Enable two-factor authentication for your Google account.
• Disable geolocation services from your operator (call support).
• Update your smartphone firmware regularly.
• Turn off Bluetooth and NFC when you are not using them.

Can an antivirus detect all spyware?

No, unfortunately, modern spyware uses the following bypass methods:

• Polymorphic code: the app changes its signature every time it is launched, so antiviruses do not recognize it. recognize.
• Use of legitimate services: for example, a spy can transmit data through Google Firebase or Amazon AWSthat antiviruses consider safe.
• Rootkits: If the software is implemented at the kernel level, it can block antivirus scanning.
• Cloud spies: Some apps do not store data on the device, but immediately send it to the server, which complicates detection.

What to do:

• Use several antiviruses (for example, Malwarebytes + Dr.Web).
• Scan the device in safe mode (press the power button → "Safe Mode").
• Keep an eye on antivirus database updates.

How to protect your phone from surveillance in the future?

Here are the basic rules of cyber hygiene for Android:

• 🔒 Do not install applications from unknown sources (turn on the ban in Settings → Security → Unknown sources).
• 🔄 Regularly update the firmware and applications - many vulnerabilities are closed in new versions.
• 🛡️ Use an antivirus with spyware protection (for example, Kaspersky Internet Security).
• 🔑 Enable two-factor authentication for all important accounts.
• 📵 Disable unnecessary ones permissions for applications (for example, access to geolocation for a flashlight).
• 🔍 Periodically check active connections via NetGuard or GlassWire.
• 🚨 Do not connect phone to public charging - use USB capacitors (they block data transfer).

For maximum protection, consider using custom firmware like LineageOS or GrapheneOS —they are deprived of many of the vulnerabilities of the standard Android.