A hot phone or battery drain can feel unsettling, especially when you can’t explain it. Isolated symptoms aren’t proof, so learning how to detect spyware on Android phones starts with separating ordinary glitches from patterns that may signal suspicious activity.
Spyware and stalkerware can collect messages, locations, notifications, or screen activity, putting digital privacy at risk. Yet slow performance can also come from a bad update, an aging battery, or a demanding app. Start with calm checks, then escalate only when the evidence warrants it.
Key Takeaways
- A hot phone, battery drain, or lag is not proof of spyware; look for several unusual changes that begin together.
- Review battery and data use, unfamiliar apps, permissions, accessibility services, notification access, and device administrator settings.
- If stalkerware may involve a partner, family member, or employer, prioritize personal safety and avoid deleting anything without considering the risks.
- Use Google Play Protect and a reputable mobile security scan, then remove confirmed unsafe apps through safe mode when necessary.
- If spyware persists, prepare carefully before a factory reset, then update the phone, secure your Google account, and avoid automatically restoring every old app.
How to detect spyware Android phones may be hiding
Detecting spyware on an Android phone starts with a mix of permissions, background activity, and hard-to-notice app names. One symptom proves little, and recent security updates can explain some changes. Several changes that begin at the same time are more meaningful.
Watch for changes you cannot link to your normal use:
| What you notice | What to check next |
|---|---|
| Battery drain, warmth, or lag | Review battery use by app and recent installations. |
| A spike in mobile data | Check which background apps used data in the current billing period. |
| An unfamiliar microphone or camera indicator | Review your privacy settings, then use Privacy Dashboard to identify the app. |
| Settings changed without your input | Check accessibility, notification access, and admin controls. |
| Strange ads, redirects, or browser tabs | Review browser notifications, downloads, and recently installed apps. |
On Android 12 and later, a green indicator appears near the top of the screen when an app uses the phone camera or microphone. If it appears when you are not making a call, recording, or using a trusted app, note the time. Then open Settings > Privacy > Privacy Dashboard to see recent camera and microphone access.
High data use deserves the same attention. On Pixel phones, look in Settings > Network & internet > SIMs > App data usage. On many Samsung phones, open Settings > Connections > Data usage > Mobile data usage. An app that uses data in the background may be legitimate, but an unknown app with heavy use needs investigation.
Put personal safety before deleting anything
A malware infection and targeted monitoring through stalkerware apps are not always the same situation. Malicious software is broader than stalkerware and often arrives through phishing links, deceptive downloads, or unsafe third-party apps. Targeted monitoring may be installed by someone with physical access to the phone, account passwords, or knowledge of your unlock code.
If you think a partner, family member, or employer could be monitoring you, avoid confronting them or removing a suspicious app straight away. Sudden changes to privacy settings or other device controls can alert the person who installed stalkerware apps.
Removing monitoring software can erase evidence and may change an abuser’s behavior. Personal safety comes before a quick technical fix.
Keep a private record of dates, unfamiliar app names, screenshots, and unusual alerts if doing so is safe. An online safety resource list can help you find local support options and protect your digital privacy. If the phone belongs to an employer or has a work profile, ask the organization’s IT team before changing device-management settings.
Audit apps, permissions, and powerful settings
A careful audit of app permissions can reveal suspicious software without installing another unknown app. Open Settings > Apps > See all apps, or Settings > Apps on Samsung devices. Look for hidden apps, unfamiliar installations, and background apps outside your normal use, especially recent ones with generic names.
Names such as “System Service,” “Update Service,” or “Device Health” are not automatic proof of malicious behavior. Android itself uses system services. Still, an app with a vague name, no familiar icon, and broad access deserves more scrutiny.
Check these settings using the Settings search box if your menu labels differ:
- Open Privacy > Permission manager and review each app’s access to location, camera, SMS, contacts, and files. Check its microphone access too, then revoke permissions it does not need.
- Search Settings for Accessibility and accessibility services. Under “Installed apps” or “Downloaded apps,” disable services you do not recognize because they can read on-screen content. Unrecognized accessibility services can also interact with other apps, making them attractive to stalkerware apps.
- Search for Notification access, then review apps with notification access. Approved apps can read notification contents, including message previews and verification codes.
- Search for Device admin apps or Device administration. A device administrator can make an app harder to remove. Verify before turning anything off because legitimate work-management or security apps may appear here.
- Search for Install unknown apps. This setting allows selected apps, such as a browser or file manager, to install APK files. Turn off permission for any app that does not need it.
Sideloaded apps arrive through an APK file from a website, email attachment, chat, or file transfer rather than directly from Google Play. Sideloading is not automatically unsafe, but it bypasses the usual Play Store distribution path and may involve third-party apps. Apps installed from Google Play can also become risky, so judge them by their behavior and app permissions, not only their installation source.
Run scans, then use safe mode for removal
First, confirm that Google Play Protect is active. Open the Play Store, tap your profile icon, choose Play Protect, then tap the settings icon. Turn on “Scan apps with Play Protect” and run a scan. This built-in check is a useful baseline, but it may miss stalkerware apps designed to look like legitimate monitoring tools.
A reputable mobile security app can provide a second opinion through an independent malware scan. In a November 2025 Android stalkerware test by EFF and AV-Comparatives, Malwarebytes detected every tested sample, while Play Protect detected 53 percent. Those results are time-sensitive evidence, not a universal guarantee. Detection changes as threats and definitions change, so treat scan results as evidence, not a final verdict.
Traditional antivirus software can miss stalkerware apps because some are sold as legal monitoring products. Some antivirus software may classify surveillance tools as legitimate rather than malicious software. Others disguise their name, abuse legitimate permissions, or change faster than detection rules update. For broader security habits, review CISA’s no-cost cybersecurity tools and services.
If you identify an app you are confident is unsafe, remove it in this order:
- Revoke its device administrator permission first, if it has one. Otherwise, Android may block removal.
- Restart in safe mode, which temporarily prevents downloaded apps from running. On most current Android phones, hold the power button, touch and hold “Power off,” then choose Safe mode. If that option does not appear, check your manufacturer’s support instructions.
- In safe mode, return to Settings > Apps, select the suspicious app, and tap Uninstall. Restart normally after removal, then run a Google Play Protect scan and your malware scan again.
If uninstall is unavailable, do not keep tapping through warnings. Take a screenshot if it is safe, then check the app’s administrator, accessibility, and notification access permissions again.
When a factory reset is the safer option
A factory reset is appropriate when spyware persists, the phone has been rooted, or you cannot identify the responsible app. It removes installed apps and local data, including photos, messages, authenticator data, and downloaded files, unless you prepare first.
Back up only the files you need, such as photos and contacts. Do not restore every old app automatically afterward, because you could reinstall the same problem. Record your account recovery codes and confirm that you can sign in to your Google account before erasing the phone.
On a Pixel, the path is usually Settings > System > Reset options > Erase all data. Samsung models commonly use Settings > General management > Reset > Factory data reset. Menu names vary by Android version.
After a factory reset, install Android and security updates before adding apps. Change your Google account password from a trusted device, review signed-in devices, and turn on two-factor authentication. The FTC’s Start with Security guidance also stresses the basics that matter here: update software, limit access, and use strong account protection.
Reduce the chance of another infection
Install apps from Google Play whenever possible, and avoid APK downloads or phishing links sent through unexpected messages. Keep Android and every installed app updated, because security updates close known weaknesses.
Use a strong screen lock that nobody else knows. Protect the Google account connected to the phone with two-factor authentication. After major updates, review app permissions and privacy settings, including accessibility, notification access, location, camera, and microphone controls. Check data usage regularly, and remove any app whose purpose does not match its access.
Antivirus software can support mobile security, but it cannot replace updates, a strong screen lock, or careful permissions. Protecting both the phone and its account supports digital privacy and helps prevent stalkerware apps from gaining access.
Frequently Asked Questions
What are the first signs of spyware on an Android phone?
Battery drain, unusual warmth, high background data use, unexplained settings changes, or unfamiliar apps can justify a closer look. None of these signs proves spyware on its own, so check for a pattern and compare it with recent updates or normal app activity.
How can I check whether an Android app is suspicious?
Review Settings > Apps along with the app’s permissions, battery use, data use, accessibility access, notification access, and device administrator status. A vague name or broad permissions deserve scrutiny, but Android system services and legitimate work-management apps can look unfamiliar.
Should I delete a suspected stalkerware app immediately?
Not always, especially if someone close to you may be monitoring the phone or could react to the change. If it is safe, record app names and unusual alerts first, and contact a trusted support service before removing the app.
Can Google Play Protect detect all Android spyware?
No, Google Play Protect is a useful baseline but can miss stalkerware or surveillance tools that appear legitimate. Run it alongside a reputable mobile security scan, and treat both results as evidence rather than a final guarantee.
When should I factory reset an Android phone?
Consider a factory reset if spyware persists, the phone has been rooted, or you cannot identify the responsible app. Back up only essential files, confirm access to your Google account and recovery codes, and do not automatically restore every old app afterward.
Stay methodical, not panicked
Checking an Android phone for spyware starts with reviewing apps and data usage alongside mobile security tools and antivirus software. A pattern of suspicious activity is more meaningful than an isolated hot battery.
When personal safety is part of the concern, pause before deleting anything. A careful record, a trusted support person, and a clean device for sensitive communication can protect you better than a rushed response.
