IMPORTANT NOTICE: If you have a concern that you may be the victim of illegal surveillance through the use of spyware and you wish to have evidence of this provided to a court of law, follow these security steps* to Contact NSI Global Today for a confidential consultation. DO NOT ATTEMPT TO REMOVE THE SPYWARE FROM YOUR DEVICE AS YOU MAY DESTROY VALUABLE EVIDENCE TO SUPPORT YOUR CASE.
Consumer-grade spyware has become a growing concern for Android phone users, posing a significant threat to their privacy and security. These malicious applications, often disguised as legitimate monitoring tools or parental control apps, are readily available on various app stores and websites. Unfortunately, they are frequently misused by individuals with malicious intent to monitor and compromise the privacy of unsuspecting victims. In this guide, NSI Global’s Digital Forensics Division will walk you through the process of identifying and removing these invasive spyware apps from your Android phone while ensuring your safety.
Understanding Consumer-Grade Spyware
Consumer-grade spyware, also known as “stalkerware,” is commonly marketed as child tracking software. However, it’s notorious for its ability to secretly track and monitor partners or spouses without their consent. These apps are typically downloaded from sources outside Google Play, installed without permission, and designed to remain hidden on the device, making them difficult to detect. Signs of infection may include unusual phone behavior, increased heat, or slower performance, even when the phone is not in use.
Prioritise Your Safety
Before you proceed with removing spyware from your Android phone, it’s crucial to have a safety plan in place. Spyware is designed to operate covertly, and removing it may alert the person who installed it, potentially creating an unsafe situation. Always prioritize your safety when dealing with stalkerware.
If you suspect your iPhone or iPad is infected by illegal spyware or under cyber attack, you are suggested to use this mode to protect your data security. However, most people won’t need to use Lockdown Mode as it restricts your iPhone seriously, deeply affecting your work, interaction, and life.
Important Note: This guide focuses on removing the spyware app itself and does not address the data that may have already been collected and uploaded to external servers. Additionally, it is crucial to note that if you wish to gather evidence of illegal stalking and surveillance, it is recommended you DO NOT ATTEMPT To REMOVE THE SPYWARE but rather, contact NSI Global through secure means (click here) to Forensically examine the phone and provide a report on the presence of the spyware. Proceed with these steps at your own discretion. Lastly, menu options shown below may vary slightly depending on your Android version.
Checking Google Play Protect
Google Play Protect is a powerful defense against malicious Android apps, whether from third-party sources or the official app store. However, when disabled, it leaves the door open for stalkerware and malware to infiltrate your device. To safeguard your phone, follow these steps:
Ensure that Google Play Protect is enabled in the Google Play app. Confirm that a recent scan has been completed.
Verifying Accessibility Services
Stalkerware / spyware typically relies on deep access to your device and often exploits Android’s accessibility feature, which requires broad access to the operating system for features like screen readers. If you encounter an unfamiliar service in the Accessibility options, consider removing it. Many stalkerware apps masquerade as innocuous apps with names like “Accessibility” or “Device Health.” Note: Before deleting an app consider contacting NSI Global.
Android spyware often abuses in-built accessibility features.
Checking for Device Admin Apps
Device admin options provide even broader access to Android, allowing stalkerware apps to record the screen and spy on the device owner. Personal phones rarely require device admin apps, so be cautious if you spot an unrecognized app with names like “System Service,” “Device Health,” or “Device Admin.”
An unrecognised item in your device admin app settings is a common indicator of phone compromise.
Identifying and Uninstalling Suspicious Apps
While stalkerware apps often hide their presence on the home screen, they may still appear in your Android device’s app list. To find and remove them, do the following:
- Access your Android Settings.
- Navigate to the list of Installed Apps.
- Look for Apps with Generic Names like “Device Health” or “System Service” and generic icons.
- If you discover an unfamiliar app, such as one you did not install, select “Uninstall”. Be aware that this action may alert the person who planted the stalkerware.
Spyware apps often have generic looking icons.
Securing Your Phone
If you suspect that stalkerware was installed on your phone, it’s essential to strengthen your phone’s security:
- Update your lock screen password to a stronger, more secure one.
- Enable two-factor authentication for your email and other online accounts whenever possible.
Seeking Help
If you or someone you know is experiencing domestic abuse or violence related to spyware or any other issue, the National Domestic Violence Hotline (1-800-RESPECT) offers 24/7 free, confidential support. In emergency situations, call 000.
By following these steps and prioritising your safety, you can take control of your Android phone and protect your privacy from consumer-grade spyware.
IMPORTANT NOTICE: If you have a concern that you may be the victim of illegal surveillance through the use of spyware and you wish to have evidence of this provided to a court of law, follow these security steps* to Contact NSI Global Today for a confidential consultation. DO NOT ATTEMPT TO REMOVE THE SPYWARE FROM YOUR DEVICE AS YOU MAY DESTROY VALUABLE EVIDENCE TO SUPPORT YOUR CASE.
PLEASE NOTE: NSI GLOBAL WILL NOT PROVIDE SERVICES TO ANY INDIVIDUAL OR ENTITY THAT IS THE SUBJECT OF ANY LAW ENFORCEMENT INVESTIGATION.
