Has your smartphone suddenly started to run out of charge in a few hours, although it previously held a charge for a day? Applications open or close on their own, and unknown services with cryptographic names appear in the list of processes? Your device may be infected with spyware a app that secretly collects data about your activity, location, or even correspondence. According to Kaspersky, in 2023, every fifth mobile virus belonged specifically to the category spyware (spyware), with 68% of attacks occurring on devices running Android.

The problem is aggravated by the fact that modern spyware is disguised as system processes use minimal resources and can remain undetected for years. For example, some versions Pegasus (Israeli spyware) are capable of self-destructing when trying to analyze, leaving behind only traces in the system kernel logs. In this article we will analyze 7 reliable ways to detect surveillance from basic checks to advanced technical methods, and also tell you how to act if suspicions are confirmed.

1. Signs of infection: when to sound the alarm

Spyware rarely reveals its presence with obvious symptoms, but there are indirect signalsthat should alert you. Pay attention to:

  • 🔋 Sharp increase in battery consumption (20-40% higher than usual) without changing usage habits. Spyware often runs in the background, constantly transmitting data over the network.
  • 📶 Unexplained traffic: mobile data or Wi-Fi is consumed at night or when the phone is idle. For example, transferring 1 GB of data per month in the background may indicate a leak.
  • 🔄 Spontaneous reboots or departures to Safe Mode. Some types of spyware conflict with system processes, causing crashes.
  • 📱 Unusual behavior of the device: the keyboard enters characters by itself, the screen turns on without touching, or unknown accounts appear in the settings.

The symptom is especially dangerous when the phone heats up for no apparent reason (for example, lying on a table with the screen turned off, but the case is hot). This may indicate background processes that are actively using the processor to encrypt or transfer data. In 2023, researchers from MIT discovered that some versions SpyNote heated the device up to 45°C precisely because of the constant activity of the GPS module.

⚠️ Warning: If you noticed two-factor authentication (2FA) messagesthat they did not send themselves (for example, codes from Google Authenticator or SMS from a bank), this is a critical sign of compromise. Immediately disconnect your device from the network and proceed to the section on removing spyware.
📊Have you ever suspected your phone of being tracked?
Yes, we have strange symptoms
No, but now I’ll think about it
I checked, but didn’t find anything
I don’t know how to determine this

2. Checking installed applications: what to look for in the list

The first step is to audit all installed apps. Spyware is often disguised as harmless utilities, for example:

  • 🔍 Calculators, flashlights, file managers with a suspiciously large size (more than 50 MB) or asking for unnecessary permissions (for example, access to SMS or microphone).
  • 📦 Applications with names in Chinese, Arabic or a random set of characters (for example, com.system.update.xyz123).
  • 🔄 Clone versions of popular apps (for example, WhatsApp Plus instead of the official one WhatsApp).
  • 📡 apps to "optimize" or "speed up" Androidwhich in fact collect data.

How to check:

  1. Open Settings → Applications → All applications.
  2. Sort the list by installation date - spyware is often installed in the background through phishing links or vulnerabilities.
  3. Check the permissions of each suspicious application: go to its settings and click PermissionsFor example, access to geolocation, microphone, camera or SMS the calculator has a red flag.

Pay special attention to applications with administrative rights (they can be found in Settings → Security → Device administrators). Spyware often requests such rights to block its deletion. For example, Cerberus (popular). Trojan for Android) disguises itself as an antivirus and requires administrative access “to protect the device.”

☑️ Checklist for checking applications

Done: 0 / 4

3. Analysis of network activity: who is transmitting your data

Spyware necessarily transfers the collected information to remote servers. To identify such connections:

  1. Use the built-in traffic monitor:
    • Go to Settings → Network and Internet → Data transfer → Mobile data usage.
    • Check which applications are consuming traffic in the background. For example, if Google Play Services transmits 500 MB per month, this is normal, but if an unknown application com.android.update sends 1 GB is suspicious.
  • Install specialized applications:
    • NetGuard (network activity blocker without root access).
    • PCAPdroid (allows you to capture network packets and analyze them for suspicious domains).

    Pay attention to domains and IP addresseswith which your device connects. For example, if you see constant requests to:

    • api.secure-data[random].com,
    • 185.143.223.43 (known IP for spy servers),
    • or domains with suspicious TLDs (.xyz, .top, .gq),

    this may indicate a data leak. To check domains, use services like VirusTotal or URLVoid.

    Sign Normal behavior Suspicious behavior
    Background traffic Up to 100 MB/month for system applications More than 500 MB/month for unknown apps
    Network connections Domains google.com, facebook.com etc. Random IP or domains with numbers
    Time activity Traffic peaks during the day (when used) Data transmission at night or during inactive hours
    Protocols HTTP/HTTPS for most applications Use of non-standard ports (for example, 4444, 8080)
    ⚠️ Attention: Some legitimate applications (for example, TikTok or Instagram) also actively use the network in the background for analytics. You can distinguish them from spyware by target domains —for official services they belong to well-known companies (for example, graph.facebook.com).

    4. Deep scan: system logs and hidden processes

    If the basic methods do not produce results, you will have to dig deeper. For this you will need:

    • 🛠️ ADB (Android Debug Bridge) — a debugging tool that allows you to view system processes.
    • 🔍 Termux — a terminal emulator for Android (install via F-Droidto avoid fakes).
    • 📄 System logswhich can be exported using applications like Logcat Extreme.

    Instructions for checking via ADB:

    1. Connect the phone to the PC and turn on USB Debugging in Settings → System → For Developers.
    2. In the PC command line, enter: 
      adb shell ps -A | grep -i "spy\|monitor\|track\|hidden"

      This will display a list of processes with suspicious names.

    3. Check open ports: 
      adb shell netstat -tuln

      Pay attention to the ports 4444, 5555, 7777 —they are often used by Trojans.

    To analyze the logs, use the command:

    adb logcat | grep -i "permission\|install\|admin\|root"

    This will help find records of unauthorized installations or requests for superuser rights.

    What to do if there is no access to ADB?

    If USB debugging is disabled, and there are suspicions of spyware, try:

    1. Install Termux and enter the command pidof -x "process_name" to search for hidden tasks.

    2. Use the application Simple System Monitor (does not require root) to view active processes.

    3. Reset the phone to factory settings (see section 6).

    5. Checking for root access and system modifications

    Many spyware require root access to be deeply embedded in the system. You can check if your device has root access:

    • Install the application Root Checker from Google Play.
    • Try running the command in Termux: 
      su

      If an input prompt appears (# instead $), which means there is root access.

    • Check for applications like SuperSU, Magisk Manager or KingRoot —they control root access.

    If root access is detected, but you did not install it, this is almost a guarantee of infection. Spyware could gain root through vulnerabilities (for example DirtyCow or Stagefright) or be pre-installed in the firmware (relevant for cheap Chinese smartphones).

    Also check system file modifications:

    • Open a root-enabled file manager (for example FX File Explorer) and go to /system/app or /system/priv-app.
    • Look for files with a modification date newer than the date of the last system update.
    • Check for suspicious APK files (for example, spy.apk, monitor.dex).
    ⚠️ Attention: On some devices (for example, Xiaomi, Huawei) modifications of system files can be legitimate - manufacturers often add their own services. Check the file names with the official firmware documentation.

    6. What to do if spyware detected

    If you find confirmation of surveillance, act immediately:

    1. Disconnect the device from the network:
      • Switch the phone to Airplane mode.
      • Turn off Wi-Fi, mobile data and Bluetooth.
    2. Uninstall suspicious applications:
      • If the app is not uninstalled in the standard way, remove administrative rights from it in Settings → Security → Device Administrators.
      • Use Malwarebytes or Kaspersky Mobile Antivirus for deep cleaning.
    3. Reset the device to factory settings:
      • Go to Settings → System → Reset settings.
      • Select Delete all data (this will remove spyware, but also all your files!).
  • Update firmware:
    • After resetting, immediately check for updates in Settings → System → System update.
    • Vulnerabilities in older versions of Android are often used to install spyware.

      • If resetting did not help (for example, spyware is embedded in the firmware), you will have to reflash the device. this:

      1. Download the official firmware for your model from the manufacturer's website.
      2. Use utilities like Odin (for Samsung), Fastboot (for Google Pixel, Xiaomi) or SP Flash Tool (for Mediatek).
      3. Perform a complete cleanup (wipe data/factory reset) before flashing.
    💡

    If spyware is detected, do not try to remove it manually this may trigger self-destruction apps and loss of evidence. It is better to immediately reset the settings or reflash the device.

    7. How to protect yourself from spyware in the future

    Preventing infection is easier than treating the consequences:

    • 🔒 Install a reliable antivirus (For example, Bitdefender Mobile Security or Norton 360) and scan your device regularly.
    • 🛡️ Disable installation from unknown sources in Settings → Security.
    • 🔄 Update Android and applications —most attacks exploit outdated vulnerabilities.
    • 📱 Use alternative app stores (for example, F-Droid) to install open source software.
    • 🔑 Set up two-factor authentication for all important accounts (preferably through a physical key or application, not SMS).

    Pay special attention phishing attacks —most spyware is installed through deception. For example, in 2023, scammers sent an SMS with the text “Your account Google Pay is blocked. Follow the link [malicious.link] to unblock." After the transition, victims downloaded an APK file that installed a Trojan for stealing bank data. SpyMax — a Trojan for stealing bank data.

    It is also recommended:

    • Periodically check application permissions in Settings → Applications and revoke unnecessary ones.
    • Use VPN (for example, ProtonVPN) when connecting to public Wi-Fi networks.
    • Configure notifications about new devices in account Google (in the section Security → Your devices).
    💡

    If you often connect your phone to public chargers (in airports, cafes), use "capacitor" USB cable (without data transfer) or disable data transfer in the USB settings. This will prevent attacks through Juice Jacking (data theft through the charging port).

    FAQ: Frequently asked questions about spyware on Android

    Can spyware Will the software be installed without my knowledge?

    Yes, there are several ways:

    • Through vulnerabilities in Android (for example, Stagefright allowed software to be installed via MMS).
    • Via phishing links (for example, fake pages Google Play).
    • Via pre-installed Software (on some Chinese smartphones).

    However, installation of most spyware requires user confirmation (for example, permission to install APK). The exception is apps with superuser rights.

    How is spyware disguised in the system?

    Modern spyware uses the following methods:

    • Name spoofing: for example, com.google.update instead of com.spy.app.
    • Injection into system processes: injection of code into legitimate applications (for example, in Google Play Services).
    • Delayed launch: activation only a few days after installation.
    • Encryption traffic: use TLS/SSL for hidden data transfer.

      • Some apps (for example, FinFishereven modify the Android kernelto remain invisible to antiviruses.

    Is it possible to remove spyware without resetting settings?

    Possible, but not guaranteed. Try:

    1. Delete the application via Settings → Applications (if it is visible in the list).
    2. Use an antivirus with a deep scan function (for example Kaspersky or Dr.Web).
    3. Remove administrative rights in Settings → Security → Device administrators.

    If the app built into the firmware or has root access, reset settings or flashing is required.

    How to check if my data is being transferred somewhere?

    Use a combination of methods:

    • Traffic monitoring: applications like GlassWire show what data and where they are sent.
    • Packet analysis: PCAPdroid allows you to capture network traffic and analyze it in Wireshark.
    • Checking DNS queries: if your device accesses suspicious domains (for example, track-user[random].xyz), this a sign of a leak.

    Pay attention to unusual ports (for example, 4444, 5555) or protocols like IRCthat spyware uses for control.

    Can spyware spy on me through a switched off phone?

    Technically no, but there are nuances:

    • Modern smartphones never turn off completely —some modules (for example, for an alarm clock or fast boot) remain active.
    • Some spyware (for example, Pegasus) can wake up the device by command from the server, even if it is "turned off".
    • If the phone discharged to 0%, surveillance is impossible (but data can be transferred the next time you turn it on).

    To be completely sure, remove SIM card and turn off the phone for a long time (or use Faraday cell a case that blocks signals).