Stalkerware on Android: Signs, Checks and Analysis

Stalkerware is monitoring software installed on another person's phone to watch them without their consent. The Coalition Against Stalkerware defines it as software, made available directly to individuals, that enables a remote user to monitor activity on another person's device without that user's consent, and that may facilitate intimate partner surveillance, harassment, abuse, stalking or violence.

Most stalkerware uses the same Android capabilities as legitimate apps — location, accessibility, notification access — and its defining feature is not a clever exploit but the absence of consent. That makes it hard to detect by signature alone, and it makes the response to a suspected case a safety question before it is a technical one.

The scale of the problem

Kaspersky's report The State of Stalkerware in 2023, published on Securelist, counted 31,031 unique users of its mobile products affected by stalkerware that year, up from 29,312 in 2022. The figure covers only Kaspersky users and only apps meeting the Coalition's criteria, so the real number is likely higher.

Latin America accounted for 5,478 of those users. Brazil ranked second worldwide, with 4,186 affected users, and Mexico ninth, with 592; within the region they were followed by Colombia, Peru, Argentina, Ecuador and Chile.

Source: Kaspersky, The State of Stalkerware in 2023. Selected rows from the top ten.

How stalkerware differs from other Android malware

A banking trojan wants money and a large number of victims it never meets. Stalkerware targets one person, and the operator usually knows the victim. Four consequences follow.

Installation needs physical access. Stalkerware typically requires physical access to the unlocked device. Google Play's current stalkerware policy took effect on 1 October 2020, so the usual path is an APK downloaded from the vendor's site with installation from unknown sources enabled.

The operator configures the permissions. Because the installer holds the phone, the permission prompts and confirmation screens that slow other malware are tapped through by the attacker, not by the victim. The protections Android added against accessibility abuse — including the restricted settings described in Android overlay attacks — add steps but do not stop someone who has the device in hand.

Concealment is the product. The Coalition's detection criteria include concealing presence, resisting uninstallation, requesting extra privileges, hiding activity, and disguising the app's name or description after installation. A stalkerware app often takes a name that reads like a system service and tries to hide its launcher icon, which Android 10 and later make harder for apps that are not part of the system.

The data is personal, not financial. Location, messages, call logs, contacts, photos, browsing history and, through accessibility or notification access, the content of messaging apps.

The line Google Play draws

Google Play's stalkerware policy defines stalkerware as code that collects or transmits personal or sensitive user data from a device without adequate notice or consent and does not display a persistent notification that this is happening.

Only apps designed and marketed exclusively for parental monitoring or enterprise management may offer tracking on Play, and they must meet minimum conditions:

• They must not present themselves as a spying or secret surveillance solution.
• They must not hide or cloak tracking behaviour or mislead users about it.
• They must show a persistent notification at all times while running, and a unique icon that clearly identifies the app.
• They must not offer a way to enable prohibited functionality, including links to noncompliant APKs hosted outside Play.

The policy also states that these apps cannot be used to track anyone else.

Notice is the dividing line Google Play applies. A persistent notification and an identifying icon are conditions for a monitoring app to stay on Play; they do not establish consent, and an app that meets them can still be used as stalkerware against an adult.

Order of operations in a suspected case

The technical instinct is to find the app and remove it. For a person who may be under surveillance by a partner or family member, that can be the wrong first step — and so can researching the problem on the phone that may be monitored.

Kaspersky's guidance, aligned with the Coalition, is explicit: do not try to erase the stalkerware, change settings or tamper with the phone before developing a safety plan. Removing the app can alert the person who installed it, which can escalate abuse, and it destroys evidence that may be needed later. The same caution applies to installing new security software or running a scan on the device before the risk of alerting the abuser has been assessed.

The sequence for anyone supporting a victim — a help desk, a fraud team, a security professional asked for help by a friend — is therefore:

1. Safety planning comes first. The person is referred to a local support organisation; the Coalition Against Stalkerware maintains contacts. Research and planning are safer from a device the other person has not had access to.
2. Documentation before any change. What is visible in the settings below is recorded with photographs of the screen taken with another device, not with screenshots on the monitored phone.
3. Account security as part of the plan. Changing passwords and closing sessions can also alert the other person, so the timing belongs in the safety plan; when it is done, it is done from a device the other person has not had access to.
4. Removal only when the plan allows it. A factory reset removes most stalkerware but also the evidence.

Where stalkerware becomes visible on Android

Reviewing these settings does not change them, but the device itself may be monitored, and nothing should be changed or removed before a safety plan is in place.

No single setting proves stalkerware is present. Kaspersky's guidance calls warning signs such as fast battery drain, high data usage and unfamiliar apps circumstantial. The places below are where stalkerware's capabilities have to be granted, which is why they are where it shows up. Menu names vary by manufacturer.

Two patterns deserve attention. An app with a generic or system-like name holding accessibility, notification access and device administration at the same time has no ordinary explanation. And Play Protect turned off on a phone whose owner did not turn it off suggests that someone else did.

Android 12 and later also show an indicator in the status bar when the camera or microphone is in use, which can reveal live recording.

What static analysis of a suspect APK establishes

When an analyst has the APK itself — extracted by a forensic specialist as part of a safety plan, never by the affected person on their own device; received as part of an investigation; or obtained from a vendor's site for research — static analysis shows what the app is built to do without running it.

No row is conclusive on its own: parental control and enterprise apps use several of them. As in other triage, the combination is the finding. Droidwatch scores combinations rather than individual permissions, maps findings to MITRE ATT&CK Mobile techniques, and extracts network indicators, which in a stalkerware case can point to the infrastructure built to receive collected data. The general method is in how to triage a suspicious APK; when the question is about an app identified only by its package name, identifying an unknown Android package name covers the lookup.

Two limits apply. Static analysis establishes capability, not what was collected from a specific phone. And submissions to Droidwatch are private by default; an APK that may be evidence in a case should not go to a service that shares uploads with third parties, as the comparison of APK analysis tools sets out.

Frequently asked questions

What is stalkerware? Monitoring software installed on someone's phone to track their location, messages and activity without their consent, usually by a person close to them who had physical access to the device.

How can stalkerware be detected on Android? By reviewing where its capabilities are granted: accessibility services, notification access, device admin apps, installation from unknown sources, location permissions, the privacy dashboard and Play Protect. An unfamiliar app holding several of these together is the strongest sign. Battery and data usage are circumstantial. Because the phone may be monitored, nothing should be changed before a safety plan is in place.

Should stalkerware be removed immediately? Not before a safety plan. Removing it can alert the person who installed it and destroys evidence. Guidance from Kaspersky and the Coalition Against Stalkerware recommends contacting a support organisation first.

Is stalkerware allowed on Google Play? No. Under the policy in force since 1 October 2020, only parental and enterprise monitoring apps may offer tracking, with a persistent notification and a clearly identifying icon, and they may not be used to track anyone else.

Can Droidwatch tell whether a phone is infected? No. Droidwatch analyses an APK file, not a phone. Given the suspect APK, it establishes what the app is built to do and which endpoints are present in its code.