← Back to Third Degree Media

🕵️ Stalkerware & Commercial Spyware — TL;DR

Type: Commercial surveillance software (often sold as "parental control") • Affects: Windows, macOS, Android, iOS • Focus: privacy & safety

Summary

Stalkerware (commercial spyware) is software packaged and sold to let a third party monitor an individual's device activity — messages, calls, location, keypresses — often without legitimate consent. It has outsized human impact (domestic abuse, stalking) and is frequently used by bad actors who already have some physical or account access to the victim's device.

What it is (high level)

These are commercial products (or derivatives) marketed as "employee monitoring", "parental control", or "device tracking". They usually offer remote dashboards where the purchaser can view call logs, SMS, app usage, GPS, microphone recordings, screenshots, and file access. Unlike mass malware, stalkerware is often installed with one of:

  • (a) Brief physical access to the device
  • (b) Social engineering to convince the owner to install
  • (c) Credential compromise

How they work (mechanisms, non-exploitative)

  • Runs as a background service/daemon with elevated privileges and persists across reboots
  • Uses legitimate OS APIs (location, accessibility, device admin) to collect data; may abuse accessibility APIs to read screen content
  • Exfiltrates data by uploading to vendor cloud dashboards or via email/FTP
  • Often bundled with a remote management portal tied to an account the purchaser controls

Notable context & impact

Numerous vendor-sold products have been used for abuse and have received media and NGO scrutiny. Law enforcement and consumer safety groups have published advisories highlighting how these products are misused. Because of the human-safety angle, many security vendors flag stalkerware differently and offer targeted detection/removal guidance with safety resources.

Detection signals (what users may notice)

  • Unexplained new apps or services listed in Settings / Applications
  • Battery drain and CPU spikes when device is idle
  • Unexpected prompts for "device admin" access or wide permissions (SMS, location, accessibility)
  • Strange outgoing connections to uncommon domains or repeated uploads at odd hours
  • New user accounts, changed lockscreen PINs, or unknown device profiles (macOS/iOS configuration profiles)
  • On desktop: background processes with unfamiliar names, removed or suppressed security alerts, or new scheduled tasks/launch agents

Forensic artifacts & places to check (non-weaponizing)

⚠️ Safety First: Collecting artifacts safely is important — if you suspect ongoing abuse, prioritize personal safety before technical steps.

Android

  • Installed package list (adb shell pm list packages if you have consent / admin rights)
  • Device admin apps, apps with Accessibility permission
  • Battery usage by app, unusual VPN profiles
  • Unexpected Google account sync entries, and app backup contents

iOS

  • Configuration profiles (Settings → General → VPN & Device Management)
  • Unexpected provisioning profiles
  • Backups (check encrypted backups on a controlled machine for suspicious entries)
  • Jailbreak indicators (unusual daemons, Cydia entries)

Note: iOS is harder to inspect safely without trusted tools and physical chain-of-custody.

Windows / macOS

  • Startup items / launch agents, scheduled tasks
  • Unusual services/daemons, newly added admin users
  • Suspicious signed binaries (mismatched publisher names)
  • Browser extensions, network connection logs

Network

  • Repeated outbound uploads to a small set of domains
  • DNS queries for vendor dashboards
  • Odd traffic to cloud storage endpoints (S3, Azure blobs) at night

Containment & safe next steps

  1. 🚨 Safety first: If your safety is at risk, contact local domestic violence resources or law enforcement first — get help before taking device actions that could escalate harm
  2. Power off or isolate the device from networks (airplane mode / remove SIM) if safe to do so
  3. Do not confront an abuser alone; seek a trusted support person when taking technical actions
  4. From a clean, separate device: change critical passwords (email, banking, cloud) and enable MFA
  5. For removal: use reputable anti-stalkerware / anti-malware tools (vendor guidance is best). If you're unsure, consult a local digital-safety organization or CERT for guided removal
  6. Preserve evidence (screenshots of unknown apps/permissions, network logs) if you intend to report abuse; redact personal information before sharing publicly

Prevention & hardening

  • Require device lock (PIN/biometric) and avoid sharing lock codes
  • Use strong account passwords and enable MFA everywhere
  • Review installed apps & permissions periodically (Accessibility, Device Admin on Android; Profiles on iOS)
  • Don't install unknown "parental control" or remote-monitoring apps without verifying vendor reputation and legal/ethical permissions
  • Educate close contacts about the legal and ethical implications of monitoring someone without consent

⚠️ This page is for education. If you or someone else is in immediate danger, call emergency services and seek in-person help.

← Back to Third Degree Media