The Complete Guide to Detecting Spyware on Phones and Computers

What “spyware” can mean — and why it changes where you look

People use “spyware” for several different problems. Stalkerware is commercial monitoring software that someone installs on the device of a person they know — usually a phone, sometimes a computer. Account access isn’t software at all: someone who knows or reset your password reads your email, photos and location from their own device. Remote-access tools are legitimate programs for controlling a computer from elsewhere, sometimes installed under the pretext of “helping”. Info-stealing malware comes from criminals through downloads and links. And mercenary spyware is expensive, targeted software used against a small number of journalists, activists and officials.

The first three are the everyday concerns, and they are what this guide focuses on. Each leaves traces in different places, which is why a single scan so often gives a false sense of security.

Before you start: check safely

As you go, write down what you find — the name, where it appeared, what it could do, and when it was installed — and photograph screens with a second device rather than taking screenshots. That record helps whether you later remove the software, hand the device to a specialist or report what happened.

Signs worth taking seriously on any device

Most online lists lead with battery drain, overheating and slow performance. On their own those signs mean very little; updates, old batteries and busy apps cause them all the time. The signs that point to monitoring are more specific: someone knowing what you wrote in private messages or where you went; security software switched off without your doing; security alerts about sign-ins or password changes you didn’t make; and software you don’t recognise holding deep access such as accessibility, device admin, screen recording or remote control. Timing matters too. Changes that started after someone had your unlocked device are the pattern to note.

How to detect spyware on phones

Android lets apps take deep access if someone grants it, and nearly all stalkerware is installed from a file rather than from Google Play. So the check is about permissions: look in Settings › Accessibility for services you didn’t add, and in Settings › Apps › Special app access for unknown apps holding device admin, notification access or usage access. Check that Play Protect is still on — some stalkerware tells the installer to disable it — but don’t treat its all-clear as final: in AV-Comparatives’ 2025 stalkerware test, run with the EFF, Play Protect detected 53% of the samples, while several dedicated security apps detected 94% or more. Our full method, including safe mode and the privacy dashboard, is in detecting stalkerware on Android.

iPhone doesn’t let App Store apps read each other’s data, so hidden stalkerware needs a jailbreak. Monitoring usually comes through the Apple Account instead, or through a management profile. Check the devices signed in under your name in Settings, the trusted phone numbers under Sign-In & Security, Settings › General › VPN & Device Management for profiles, and Safety Check under Privacy & Security for sharing. Look in the App Library for package-manager apps that suggest a jailbreak. The details are in checking an iPhone for stalkerware.

How to check a Windows PC for spyware

Monitoring software on a computer needs to run every time the computer starts, so begin with what starts. Press Ctrl + Shift + Esc to open Task Manager and choose Startup apps. Each entry shows a publisher; a blank or unfamiliar publisher, a name imitating a Windows component, or remote-access software you didn’t install are the ones to research. Right-click an item to open its file location or search online. Then open Settings › Apps › Installed apps, sort by install date, and look at anything that arrived when someone else had use of the computer.

Next, check Settings › Privacy & security. The Microphone, Camera and Location pages each show recent activity by app, and an icon appears on the taskbar while they are in use. Regular use by an unknown program at night is worth recording. Also look at remote access: Settings › System › Remote Desktop should be off unless you use it, and any remote-support program in the installed list should be one you chose. Check your browsers too — extensions you didn’t add, and profiles synced to an account you don’t control.

Finally, scan. Windows Security’s Microsoft Defender Antivirus (offline scan), under Virus & threat protection › Scan options, restarts the PC and scans from outside the running system. Microsoft recommends it when you suspect malware that is hard to remove. Be realistic about the result: consumer monitoring software is often marketed as legitimate, and an antivirus may not flag it. The startup and permission checks are what catch that.

How to check a Mac for spyware

macOS makes apps ask for permission, one by one, before they can record the screen, log keystrokes or read your files. That makes the permission lists the best place to look. Open System Settings › Privacy & Security and go through Accessibility, Input Monitoring, Screen & System Audio Recording and Full Disk Access. Video-call and screenshot apps legitimately appear in some of them. An unfamiliar “agent” or “helper” in several of them is the monitoring pattern.

Then check General › Login Items & Extensions for what opens at login and what is allowed to run in the background, General › Sharing for Remote Login, Remote Management and Screen Sharing, and General › Device Management for any profile you didn’t install. Older macOS versions keep the same controls under System Preferences › Security & Privacy and Profiles.

Check your accounts, whatever device you use

Account access is the route most often missed, because nothing appears on any device. In each email account, open the settings for forwarding and filters: a forwarding address or a rule that forwards and then deletes certain messages is a serious finding. Check the signed-in devices on your Google, Apple and Microsoft accounts and in social apps; the linked devices in messaging apps such as WhatsApp, Telegram and Signal; and whether your browser is synced to a profile someone else uses.

When you’re ready to act, change the password from a safe device first, turn on two-factor authentication with your own number, and only then remove unknown sessions, rules and recovery details. In the reverse order, they can simply be recreated.

Start from what they know

If you don’t know which device to check first, work backwards from what the other person seems to know. The kind of information points to the route, and the route points to the device or account worth checking first.

More than one row may apply. People who monitor a partner often use several routes at once, which is why closing one and stopping there so often fails.

Beyond phones and computers

Some monitoring never touches a phone or a computer. Bluetooth item trackers can be slipped into a bag or car; iPhone warns when an unfamiliar AirTag or compatible tracker seems to be travelling with you, and Android phones have unknown-tracker alerts as well. Connected cars often come with an app that shows the car’s location to whoever holds the account. Smart-home cameras, doorbells and speakers can be viewed by anyone with access to their app. If a shared account controls any of these, check who else is signed in, and change the password when it is safe to do so.

Which tools find what

Scanners also flag legitimate, visible monitoring tools, such as parental-control and family-location apps, including ours. That is by design: a scanner can’t know whether you agreed to it.

If you find something

Resist the urge to delete it straight away. Photograph what you found with another device, add it to your log, and — if someone you know may be responsible — talk to a domestic-abuse support service about timing before you remove it, reset the device or change passwords. Removal, a factory reset and a new device all end monitoring through that device, but none of them fixes account access; do the account steps at the same time. If no one you know is involved and it looks like ordinary malware, you can move quickly: scan, remove, reset if needed, and change passwords.

How this page was put together

We checked menu paths in September 2026 against Google’s Android and Play Protect help, Apple’s Personal Safety User Guide and Mac User Guide, and Microsoft’s Windows Security documentation, including its offline scan page. Detection figures come from AV-Comparatives’ Stalkerware Test 2025, published with the EFF. Settings move between versions, so search for a label if it isn’t where we describe it.

We didn’t install spyware on test devices for this guide; the app names shown are invented. Our editorial standards page explains how we research and correct guides.