The smartphone has become an integral part of life - we store photos, correspondence, bank card data and even biometrics in it. But what if someone is spying on your activities through hidden software? According to Kaspersky, in 2023, every fifth mobile virus was a spyware application masquerading as legitimate services. At the same time, 68% of users are not even aware of the presence of “bugs” in their devices.

Detecting a surveillance app on Android is more difficult than on iOS due to the open architecture of the system and the possibility of installing APKs from unverified sources. Attackers use this to track location, read SMS, record conversations, or even turn on the camera remotely. In this article we will look 7 proven methodshow to identify spyware, including hidden signs, analysis of system logs and tools for in-depth diagnostics. And also - what to do if surveillance is confirmed.

Important: some methods require root access or technical knowledge. If you are not confident in your abilities, it is better to contact a specialist - incorrect actions can lead to data loss or blocking of the device.

1. Signs of spyware: when to sound the alarm

Before delving into the settings, pay attention to indirect signsthat may indicate surveillance. They do not always mean the presence of spyware, but they should alert you:

  • 🔋 Rapid battery drain - if the phone dies after 3-4 hours without active use, there may be a hidden application running in the background that transfers data.
  • 📶 Increased traffic - check your mobile data consumption in Settings → Network and Internet → Data transfer. Unusual growth (for example, +500 MB per night) may signal the transfer of your data.
  • 🔊 Extraneous sounds during calls - clicks, echoes or background noise sometimes indicate wiretapping (although it may be hardware problem).
  • 📱 Spontaneous reboots —spyware can conflict with the system, causing crashes.
  • 🔍 Unknown SMS or calls —short calls to strange numbers (for example, +12345) or messages with commands (for example, "USSD codes") are often used to manage spyware utilities.

You should be especially wary if several signs appear at the same time. For example, the combination of rapid battery drain, increased traffic and the spontaneous activation of the microphone (the indicator blinks without a call) with an 80% probability indicates surveillance..

⚠️ Attention: Some legitimate applications (for example, Google Services or Facebook) also actively use the battery and Internet. Before you panic, check them in Settings → Applications → Permissions.
📊 Have you ever suspected that you were being monitored through your phone?
Yes, there were clear signs
No, but now I’ll think about it
I checked, but didn’t find anything
I don’t think it’s possible

2. Checking installed applications: what to look for in the list

The first step is to audit all installed apps. Spyware often disguises itself as harmless utilities: calculators, flashlights, cache cleaners, or even games. Here's how to check the list:

  1. Open the full list of applications: Settings → Applications → All applications (the path may differ on some firmware).
  2. Sort by installation date: Click on the three dots in the upper corner and select “Sort by date”. Unknown apps installed without your knowledge will be visible immediately.
  3. Check access rights: Tap on the suspicious application and see what Permissions it asks for. Spyware often requires access to:
    • 📍 Location (even when the application is not in use)
    • 📞 Calls and SMS
    • 🎤 Microphone
    • 📷 Camera
    • 📂 Files and contacts

Pay attention to applications with names like: System Update, Android Service, Device Manager or Clean Master (if you have not installed them). Also check applications from unknown developers - for example, with names in Chinese or a random set of letters (com.abc.xyz123).

Symptom Example of spyware What it does
Disguises as system software Android System Update, Google Play Update Tracks location, intercepts SMS
Asks for unnecessary permissions Flashlight (flashlight) with access to contacts Steals the address book
Installed without your knowledge com.secure.android, service.apk Records calls, makes screenshots
Consumes a lot of traffic Data Manager, Network Booster Transfers data to a remote server

☑️ Checklist for checking applications

Completed: 0 / 4

3. Analysis of network activity: who is transmitting. your data

Spyware constantly sends data to remote servers. You can calculate it by analyzing network activity. Here's how to do it:

Method 1. Built-in Android tools

Go to Settings → Network and Internet → Data transfer → Mobile data usageHere you will see a list of applications and. the amount of data transferred. Pay attention to:

  • 📊 Unknown apps in the top traffic.
  • 🌐 Suspicious domains — if the application communicates with servers in China, Russia or countries with a low level of cybersecurity (checked through NetGuard or PCAPdroid).
  • 🕒 Activity during non-working hours time - for example, if WhatsApp transmits data at night when you are sleeping.

Method 2. Specialized applications

For in-depth analysis, use the following utilities:

  • 🛡️ NetGuard —shows which applications connect to the network and blocks suspicious connections.
  • 🔍 PCAPdroid —captures network traffic and allows you to analyze where data is leaking (requires technical knowledge).
  • 📡 GlassWire —visualizes activity by IP addresses and identifies suspicious connections.

Example: if you see that an application com.secure.update sends data to an IP address in Hong Kong, and you have never used services from this region, this is a cause for concern.

⚠️ Attention: Some antiviruses (for example, Avast or 360 Security) themselves collect user data. Before installation, check their reputation on VirusTotal or Reddit.
💡

If you find a suspicious one IP address, check it through the service IPinfo.io or Whois. Spyware servers are often registered to shell companies in offshore companies.

4. Checking administrator rights and special features

Spyware is often requested administrator rights or accessibility (for example, to read the screen or control the device). This allows them to bypass standard Android restrictions. How to check:

Administrator rights:

  1. Go to Settings → Security → Device Administrators (the path may differ on some firmware).
  2. Look at the list of applications with admin rights If there is anything here other than Google Play Services, Find My Device or. antivirus - this is suspicious.
  3. Disable rights for unknown apps (click on the application and select “Deactivate”).

Accessibility:

  1. Open Settings → Accessibility → Installed services.
  2. Check if there are apps with names like Accessibility Service, Auto Clicker or Screen Readerif you have not installed them.
  3. Disable suspicious services - they can be used to record clicks (keylogging) or control the device.

Example: an application TeamViewer QuickSupport may be legitimate if you used it for remote assistance. But if you didn’t install it, this is a sign of surveillance.

What to do if you can’t disable admin rights?

Some spyware blocks disabling through the standard menu. In this case:

1. Go to Settings → Applications, find the suspicious app and click “Uninstall”.

2. If the "Delete" button is inactive, try disabling the application via adb:

adb shell pm disable-user --user 0 com.example.spyapp

3. As a last resort, reset the phone to factory settings (see section 7).

5. Finding hidden files and processes

Spyware often hides its files in system folders or disguises processes as system ones. To find them, you will need a file manager with root access (for example, Root Explorer or FX File Explorer) or terminal.

Search for hidden files:

  • 📁 Open the file manager and turn on the display of hidden files (the “Show hidden” option in the menu).
  • 🔍 Check the folders:
    • /data/app/ — APKs of all installed apps are stored here.
    • /system/app/ or /system/priv-app/ — system applications (requires root).
    • /sdcard/ — sometimes spyware saves logs here (look for files with the extension .log, .db or .dat).
  • 🚨 Pay attention to files with random names, for example: com.android.security.update.apk, system_service_config.xml, backup_data.dat.

Check processes:

To analyze running processes, use the application Simple System Monitor or the command in the terminal: 

su

ps -A | grep -i "spy\|track\|monitor\|service"

This command will show all processes with suspicious names. If you see something like com.spy.tracker or hidden.service this is a clear sign. surveillance.

⚠️ Attention: Deleting system files without root access can cause the device to crash. If you are not sure, make a backup via TWRP or Titanium Backup.

6. Using antiviruses and specialized scanners. data-i="191">Although antiviruses do not provide a 100% guarantee of detecting spyware, they can detect known threats. Here are the tools worth using:

Although antivirus software is not 100% guaranteed to detect spyware, it can detect known threats. Here are the tools you should use:

  • 🛡️ Malwarebytes - specializes in detecting spyware and adware modules. The free version scans on demand, the premium version scans in real time.
  • 🔍 Kaspersky Mobile Antivirus - has a database of spyware signatures and checks rights. applications.
  • 📱 CertiK OS (for advanced users) - analyzes the behavior of applications and identifies suspicious activity.
  • 🔐 iSpyoo Detector - a specialized scanner for searching for popular spyware utilities (mSpy, FlexiSPY, SpyEra).

How to scan correctly:

  1. Install an antivirus from Google Play (not from APK!).
  2. Update signature databases.
  3. Run deep scan (not fast!).
  4. Check results: if the antivirus finds Android.Spy, Trojan.SMS or RiskWare this is confirmation of surveillance.

Please note: some antiviruses can detect legitimate apps (for example, false positives to legitimate apps (for example, TeamViewer or AnyDesk).Always check detected threats manually.

💡

No antivirus guarantees 100% detection of spyware. Modern surveillance apps often use obfuscation and polymorphic code techniques to evade scanning.

7. Extreme measures: factory reset and flashing

If you find evidence of surveillance, but cannot remove spyware (for example, it is built into the firmware or has superuser rights), radical methods remain:

Reset to factory settings:

  1. Make a backup copy of important data (photos, contacts) to external media or the cloud.
  2. Go to Settings → System → Reset settings → Delete all data.
  3. Confirm the action. The device will reboot and return to its out-of-the-box state.

Flashing (for advanced users):

If surveillance is built into the firmware (for example, on cheap Chinese phones), only a complete flashing via Fastboot or TWRP: 

fastboot flash system system.img

fastboot flash boot boot.img

This will require official firmware from the manufacturer’s website and an unlocked bootloader.

⚠️ Attention: On some devices (for example, Xiaomi, Huawei), resetting the settings does not delete data from the folder /sdcard/Format it manually before selling or transferring the phone.

After reset:

  • 🔄 Do not restore data from a backup - spyware may return.
  • 🔒 Set a strong password and enable two-factor authentication for Google Account.
  • 🛡️ Install an antivirus and check your phone again.

FAQ: Frequently asked questions about surveillance on Android

Is it possible to detect surveillance without root access?

Yes, most methods (checking applications, network activity, antiviruses) work without root. However, some spyware is hidden deep in the system, and you may need rights to detect them. superuser.

How to spy on me if I did not install any suspicious apps?

There are several ways:

  • 📱 Physical access: Someone could install spyware when the phone was left unattended.
  • 🔗 Phishing links: Following a malicious link (for example, in an SMS or messenger) can lead to a hidden installation.
  • 📦 Vulnerabilities in the firmware: On some cheap phones, spy modules are embedded by the manufacturer (for example, the scandal with BLU Products in 2016 year).

Can they track my location if GPS is turned off?

Yes. Modern spyware determines location by:

  • 📡 Cell towers (even without GPS).
  • 📶 Wi-Fi networks (by nearby access points).
  • 🌐 IP address (less accurate, but allows you to determine the city).

To completely disable tracking, use airplane mode or specialized applications like AppOps to block access to geodata.

How to protect yourself from surveillance in the future?

Follow these rules:

  • 🔒 Set a password for the lock screen and enable device encryption (Settings → Security → Encryption).
  • 🚫 Do not install APKs from unverified sources (even if it "hacked" games).
  • 🔍 Regularly check application permissions in Settings → Applications → Permissions.
  • 🛡️ Use a VPN (for example, ProtonVPN) for encryption traffic.
  • 📱 Update the firmware - manufacturers regularly close vulnerabilities that spies exploit.

Can an antivirus itself be spyware?

Yes, some “antiviruses” (especially from unverified sources) collect data themselves.

  • Virus Cleaner 2019 (actually steals SMS).
  • Super Cleaner (sends browser history to servers in China).

Install only trusted antiviruses: Malwarebytes, Kaspersky, Bitdefender. Before installing, check reviews on Reddit or 4PDA.