Stalkerware refers to software, apps, or devices that enable someone to secretly monitor another person's private life through a mobile device. The software runs silently in the background without the affected person's consent or knowledge. According to the Coalition Against Stalkerware, an unauthorized observer can remotely track web searches, physical location, incoming and outgoing text messages, photos, and voice calls. In many cases, these programs can also record audio, capture video, and log keystrokes.
Public health and legal specialists categorize stalkerware as a distinct form of technology-facilitated abuse. This category encompasses partner surveillance, harassment, and domestic violence. Because stalkerware operates through close personal access, it is generally tied to relationship dynamics where one party seeks control over another, rather than indiscriminate cybercrime. While buying or selling monitoring software may be legal in certain jurisdictions, installing it on an adult's device without their knowledge is frequently a crime. Legal accountability rests on the individual deploying the tool, regardless of whether the vendor sold it commercially.
How Stalkerware Enters a Device and Avoids Notice
Despite public perception that digital surveillance happens entirely across the internet, the installation process usually requires physical contact. Findings published by AV-Comparatives in their 2025 stalkerware test show that most stalkerware cannot be installed remotely. In almost all instances, the person configuring the tracker requires direct, unrestricted physical access to the device, alongside the device passcode or unlock pattern.
Once installed, stalkerware typically suppresses its own application icon, hides from standard launcher menus, and runs uninterrupted processes in the background. It then transmits collected personal data to an external server or private account. Some developers operate these tools as commercial subscription services complete with customer support desks and affiliate programs. Vendors routinely attempt to shield themselves by displaying legal disclaimers that instruct buyers to obtain permission before installation. However, independent testing describes these notices as largely meaningless, since the programs are intentionally engineered to remain hidden, invisible, and difficult to trace.
A significant challenge in identifying stalkerware is the dual-use nature of the underlying code. Many functions found in surveillance apps mirror the features built into legitimate parental controls or enterprise employee-monitoring suites. This overlap creates a persistent grey market, allowing tools that are advertised for child safety or corporate asset tracking to be redirected for interpersonal spying.
Current Research on Detection Rates
Data collected over recent years confirms that consumer exposure to commercial monitoring apps has expanded. Figures released by cybersecurity firm Kaspersky indicated that the count of antivirus users finding stalkerware on their devices rose 35 percent between 2018 and 2019, climbing from 27,798 to 37,532 recorded incidents. Across the same timeframe, the firm identified 380 unique variants active in the wild, representing a 31 percent annual increase. While those historical figures capture only the customer base of one security firm, they established that invasive mobile tracking had moved into the mainstream software market.
Institutional coordination followed. In November 2019, human rights organizations and cybersecurity firms, including the Electronic Frontier Foundation and domestic violence support networks, founded the Coalition Against Stalkerware. The working group formed to standardize industry definitions, clarify detection criteria, and establish reliable mechanisms that allow mobile security suites to flag invasive tracking without falsely classifying consensual family-management apps.
Even with coordinated industry action, mobile scanning tools do not deliver uniform results. The AV-Comparatives 2025 stalkerware test evaluated 13 widely used Android security utilities against 17 current test cases between August and September 2025. The evaluations measured raw detection rates alongside the clarity of security alerts, such as whether a scan classified a file as general "monitoring software" or an explicit "malicious app." Independent researchers continue to characterize mobile detection as a mixed bag. No single scanning tool currently guarantees complete discovery of hidden surveillance software.
Warning Signs and Safety Planning
Identifying stalkerware requires monitoring both technical irregularities and changes in daily device behavior. A phone running an unauthorized monitoring tool often shows signs of persistent background activity. Because most commercial stalkerware requires physical handling to install, primary warning signs often involve device access rather than remote software vulnerabilities:
- An app that operates without an associated home-screen icon, stays hidden from application drawers, or runs continuously in the background without explicit setup.
- The presence of unfamiliar applications configured as system administrators, device managers, or parental trackers.
- Unrestricted physical access granted to an individual who knows the master passcode or who recently handled the phone unattended.
- Unexplained battery drain or elevated background data usage caused by continuous location tracking and file transmissions.
If you suspect an active surveillance app is installed, traditional security advice, such as immediately changing passwords or running a factory reset, can introduce physical danger. Removing an application or altering access credentials can alert an abuser immediately. The National Network to End Domestic Violence recommends careful planning before taking action on a compromised phone. For immediate safety concerns, individuals can reach the National Domestic Violence Hotline by calling 1-800-799-SAFE, texting START to 88788, or visiting TheHotline.org, and local authorities should be called via 911 when safe to do so. The network also advises individuals to clear their mobile browser histories after accessing safety resources.
Financial Account Exposure and Unresolved Questions
While stalkerware tracks device inputs and communications, consumer guidance documents leave notable blind spots regarding direct financial effects. Research reports demonstrate that these programs can log keystrokes, record screens, and read text messages. However, existing testing reports do not explain specifically how stalkerware might intercept banking applications, capture one-time multifactor verification codes, or alter joint account permissions. Guidance published on Federal Trade Commission consumer advice pages addresses technological surveillance, but detailed administrative procedures for securing credit cards or banking apps against stalkerware remain unverified in tested sources.
Because changing account credentials on a compromised phone can expose the new login details through keylogging, financial security steps should generally occur from an uncompromised device, such as a secure computer at a public library or a separate phone. Those who suspect monitoring must balance account defense with physical safety. Working directly with a domestic violence advocate can help an individual establish an independent financial communications path before altering passwords or freezing joint credit files.
Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.
