Spyware: What It Is, How to Detect It and How to Remove It

Spyware is software that secretly watches what you do on a device and sends that information to someone else. It can read your passwords, messages and browsing history without any visible sign, which is why it is one of the most invasive kinds of malware. This guide explains what spyware is, how it spreads, how to find it on Windows, Mac, iPhone and Android, and how to get rid of it and stay protected.

What Is Spyware?

Spyware is a type of malicious software (malware) designed to collect information about a person, device or organisation without their knowledge or consent. It runs quietly in the background, records activity and passes the data to a third party, such as a cybercriminal, an advertiser or, in the case of stalkerware, a person who wants to monitor you.

Not all monitoring software is illegal. Parental-control tools and employer-managed devices track activity openly and with consent. Spyware is different because it is hidden, installed without permission and built to avoid being noticed or removed.

What Does Spyware Do?

Spyware collects personal and financial information and reports it back to whoever controls it. What it captures depends on the type, but common activities include:

Logging every keystroke, including passwords and card numbers (keyloggers)
Capturing screenshots, screen recordings or webcam and microphone feeds
Tracking browsing history, searches and the sites you log in to
Reading emails, text messages and chat apps
Collecting contacts, call logs, photos and files
Tracking your location through GPS
Changing browser settings, injecting ads or redirecting searches

The stolen data is used for identity theft, bank fraud, account takeover, blackmail, targeted advertising or personal surveillance.

Common types of spyware

Type	What it does
Adware	Tracks browsing to serve intrusive ads and may redirect searches
Keyloggers	Record everything you type
Infostealers	Harvest saved passwords, cookies, crypto wallets and autofill data
Trojan spyware	Disguised as a legitimate app or file, then spies in the background
Stalkerware	Installed on a phone by someone close to the victim to read messages and track location
Mobile spyware	Targets calls, texts, camera and GPS on iOS and Android

How Does Spyware Work?

Spyware works in four stages: it gets onto a device, hides itself, collects data and sends it out.

Infiltration. The software arrives through a bundled download, a malicious link, a fake app or a security flaw (see the next section).
Concealment. It hides from the user by using a misleading name, removing its icon, running as a background process or setting itself to launch at startup. Some versions disable antivirus tools or reinstall themselves after deletion.
Monitoring and collection. It records activity such as keystrokes, screens, messages and location, often storing the data locally in a hidden file.
Exfiltration. The data is sent to a remote server controlled by the attacker, usually in small, encrypted transfers that blend in with normal internet traffic.

Because the whole process is built to stay invisible, spyware is often found by its side effects rather than by the user noticing the program itself.

How Does Spyware Get on a Computer?

Spyware usually gets onto a computer because the user is tricked into installing it, or because an unpatched flaw lets it in. The most common routes are:

Bundled software. Free programs, cracked software and browser toolbars often hide spyware in the installer’s “optional” extras.
Phishing emails and messages. A malicious attachment or link installs the payload when opened.
Fake updates and fake apps. Pop-ups claiming your browser, media player or PDF reader is out of date, or apps that imitate real tools.
Malicious ads and compromised websites. Drive-by downloads can install code when a page loads, especially on outdated browsers.
Software vulnerabilities. Unpatched operating systems, browsers and apps can be exploited with little or no user action.
Infected USB drives and shared files. Removable media and pirated downloads can carry spyware between devices.
Physical access. On phones in particular, someone with your unlocked device or passcode can install monitoring apps in minutes.
Malicious browser extensions. Extensions with broad permissions can read everything you do in the browser.

Once the installer runs, the spyware usually adds itself to the startup list so it survives a restart.

Warning Signs of Spyware

No single symptom proves spyware is present, but several of these together are a strong reason to investigate:

The device is slower than usual, freezes or crashes
The battery drains quickly or the device runs hot while idle
Data usage jumps without a clear reason
The browser homepage, search engine or new-tab page changed on its own
New toolbars, extensions or pop-up ads appear
Unfamiliar apps or programs you did not install
The camera or microphone indicator turns on unexpectedly
Antivirus or security settings are switched off
Accounts show login alerts from unknown places or devices
Someone knows things about you that you never told them

How to Detect Spyware on a Computer

The fastest way to detect spyware on a Windows PC is to run a full scan with up-to-date security software, then check running processes, installed programs and startup items by hand. Work through these steps in order:

Run a full scan. Open Windows Security, go to Virus & threat protection, choose Scan options and run a Full scan. For stubborn infections, choose Microsoft Defender Offline scan, which restarts the PC and scans before Windows loads. A second opinion from a reputable on-demand anti-malware scanner is also worthwhile.
Check Task Manager. Press Ctrl + Shift + Esc and look under the Processes and Startup apps tabs for unfamiliar names, or for programs using high CPU, memory or network while you are idle. Search any name you do not recognise before ending it.
Review installed programs. Go to Settings > Apps > Installed apps, sort by install date and remove anything you do not remember installing.
Inspect browser extensions and settings. Remove extensions you do not use and check that the homepage, default search engine and proxy settings are unchanged.
Check network activity. In Task Manager’s Performance tab, or Resource Monitor’s Network tab, look for unknown programs sending large amounts of data.
Look at startup items. Use Task Manager’s Startup apps tab, or a free tool such as Microsoft’s Autoruns, to spot entries that launch automatically with an odd publisher or file location.
Check security settings. Confirm that antivirus, the firewall and real-time protection are still on and that nobody has added unexpected exclusions.

If you find spyware, disconnect from the internet, remove it with your security software, then change your passwords from a different, clean device.

How to Find Spyware on a Mac

Macs are less targeted than Windows PCs, but they are not immune, and infostealers and adware aimed at macOS are well documented. To find spyware on a Mac, check for unfamiliar processes, permissions, login items and profiles:

Check Activity Monitor. Open Activity Monitor (Applications > Utilities) and sort by CPU, Memory and Network. Look for unfamiliar processes that stay busy while the Mac is idle.
Review Login Items. Go to System Settings > General > Login Items & Extensions and remove anything you do not recognise. Also review the extensions listed there.
Audit privacy permissions. In System Settings > Privacy & Security, open Accessibility, Input Monitoring, Screen Recording, Camera, Microphone and Full Disk Access. Spyware needs these to watch you, so remove any app you do not trust.
Look for configuration profiles. If System Settings shows a Profiles section under Privacy & Security or General > Device Management and you did not set up a work or school profile, remove it.
Inspect launch agents. In Finder, choose Go > Go to Folder and check ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons for items with odd names that you cannot tie to installed software.
Check Applications and browser extensions. Sort Applications by date added and remove unknown apps; review extensions in Safari, Chrome and Firefox.
Run a reputable anti-malware scan. A dedicated Mac scanner can find adware and spyware that macOS’s built-in protections miss.

Keep macOS updated, since Apple’s built-in XProtect malware definitions and Gatekeeper rely on current updates.

How to Detect Spyware on an iPhone

iPhones are well protected by Apple’s app sandboxing and App Store review, so spyware is rare and usually appears in two forms: monitoring apps installed by someone with access to your phone or Apple ID, and sophisticated targeted attacks. Phones that have been jailbroken are at much higher risk. To check your iPhone:

Look for unfamiliar apps. Swipe through every Home Screen page and the App Library, and check Settings > General > iPhone Storage for apps you do not recognise.
Check for a jailbreak. Apps such as Cydia, or a phone that has been modified to allow unofficial software, are a red flag.
Review profiles and device management. Go to Settings > General > VPN & Device Management. Delete any configuration profile you did not install yourself.
Check your Apple Account. In Settings, tap your name and review the list of signed-in devices. Remove any you do not own, and check that no one else knows your Apple Account password.
Check app permissions. Go to Settings > Privacy & Security and review which apps can use Location Services, the Camera, Microphone, Photos and Contacts. Also look at App Privacy Report to see which apps accessed sensors and which domains they contacted.
Use Safety Check. If someone you know may be monitoring you, Settings > Privacy & Security > Safety Check lets you review and stop sharing with people and apps.
Watch for indicators. The orange and green dots in the status bar show when the microphone or camera is in use.

Unusual battery drain, heat or data use alone does not mean spyware, because they are often caused by apps, updates or poor signal.

How to Remove Spyware from an iPhone

The most reliable way to remove spyware from an iPhone is to delete suspicious apps and profiles, update iOS, secure your Apple Account, and, if needed, restore the phone. Steps, from least to most drastic:

Update iOS. Go to Settings > General > Software Update. Updates patch the vulnerabilities that targeted spyware relies on.
Delete suspicious apps and profiles. Press and hold an unknown app and choose Remove App, and delete unknown profiles in Settings > General > VPN & Device Management.
Secure your accounts. From a trusted device, change your Apple Account password, turn on two-factor authentication, remove unknown devices, and change passwords for email and banking. Then change your iPhone passcode.
Restart the phone. A simple restart can interrupt some non-persistent malware.
Turn on Lockdown Mode if you are at high risk. Settings > Privacy & Security > Lockdown Mode sharply reduces the attack surface for rare, targeted attacks.
Factory reset as a last resort. Back up only your essential data (photos and contacts, not whole-device backups if you suspect the backup is compromised), then go to Settings > General > Transfer or Reset iPhone > Erase All Content and Settings. Set the phone up as new rather than restoring from an old backup.
Get help if needed. If you think you are being targeted, contact Apple Support, and if you are in danger from someone monitoring you, consider a local support service before changing settings, because removing monitoring can alert the person watching.

If the iPhone is jailbroken, restoring it through a computer using Apple’s recovery mode returns it to a clean, official state.

How to Detect and Remove Spyware from Android

Android is more open than iOS, so spyware usually arrives through apps installed from outside Google Play (sideloading) or through apps that abuse accessibility and device-admin permissions. Menu names vary slightly by manufacturer, but the steps are similar.

Detect spyware on Android

Scan with Google Play Protect. Open the Play Store, tap your profile icon, choose Play Protect and tap Scan.
Review the app list. Go to Settings > Apps and look for unfamiliar apps, apps with generic names such as “System Service”, or apps with no icon.
Check special permissions. In Settings > Apps > Special app access, review Device admin apps, Accessibility, Notification access and Install unknown apps. Spyware often relies on these.
Check data and battery use. Look at Settings > Network & internet (data usage) and Battery for apps using far more than expected.
Check the Privacy dashboard. On recent Android versions, Settings > Security & privacy > Privacy shows which apps recently used the camera, microphone and location, and green dots appear in the status bar during use.
Review Google account activity. At myaccount.google.com, check Security for unknown devices and sign-ins.

Remove spyware from Android

Boot into Safe Mode. Hold the power button, then press and hold Power off and tap OK. Safe Mode disables third-party apps, which often stops spyware from running.
Revoke special permissions. Remove device admin and accessibility access for the suspicious app first, since many cannot be uninstalled while these are active.
Uninstall the app. Go to Settings > Apps, select it and tap Uninstall.
Update Android and your apps. Install every pending system and security update.
Change your passwords for your Google account, email and banking from another, clean device, and turn on two-step verification.
Factory reset if the spyware persists. Back up photos and contacts only, then go to Settings > System > Reset options > Erase all data. Do not restore a full backup taken after the infection began.

If someone you know may have installed monitoring software, think about your safety first, because removing it may alert them. Local domestic-abuse and cybersecurity support services can help you plan.

How to Prevent Spyware

The best protection is a combination of updated software, cautious downloading and strong account security. Ten habits make the biggest difference:

Keep everything updated. Turn on automatic updates for your operating system, browser and apps so known vulnerabilities are patched.
Use reputable security software. Keep real-time protection on, on Windows (Microsoft Defender or a trusted alternative), and consider a reputable security app on Mac and Android.
Download only from official sources. Use the App Store, Google Play, Mac App Store or the developer’s own website, and avoid cracked software and “free” key generators.
Read installers carefully. Choose custom installation and untick bundled extras.
Think before you click. Treat unexpected emails, texts and pop-ups with suspicion, especially those with urgent warnings, attachments or shortened links.
Limit permissions. Give apps only the access they need, and be wary of any app that asks for Accessibility or Device Admin access.
Use strong, unique passwords with two-factor authentication. A password manager makes this practical, and it limits the damage if a keylogger captures one login.
Lock your devices. Use a strong passcode and biometrics, and do not share your passcode, since many phone spyware cases begin with physical access.
Be selective with browser extensions. Install only those you need from official stores, and remove unused ones.
Back up regularly. Keep an offline or cloud backup so you can restore a clean system if you need to wipe a device.

On public Wi-Fi, avoid logging in to sensitive accounts unless you use a VPN or your mobile connection.

What to Do After a Spyware Infection

Once spyware is removed, assume that anything typed or stored on the device may have been seen, and act on that:

Change passwords for email, banking, social media and shopping from a clean device, starting with email
Turn on two-factor authentication everywhere it is offered
Check bank and card statements and consider alerting your bank or placing a fraud alert or credit freeze if financial details were exposed
Review account recovery details, forwarding rules and connected apps on your email account
Tell your employer’s IT team if a work device or work account was involved
Report serious cases such as fraud or stalking to the police or your national cybercrime reporting service

Frequently Asked Questions

Can spyware be removed without a factory reset?

Often, yes. Most spyware on computers can be removed with a full security scan and by deleting the program and its startup entries. A factory reset is the last resort for stubborn infections on any device.

Can antivirus detect spyware?

Most reputable antivirus and anti-malware tools detect known spyware, but new or highly targeted spyware can slip past. Combining real-time protection with regular manual checks gives the best coverage.

Can someone install spyware on my phone remotely?

Most phone spyware needs physical access or your credentials, or tricks you into installing it. Remote infection without any action by the user is possible only with advanced, expensive targeted attacks and is rare for ordinary users.

Is spyware the same as a virus?

No. A virus spreads by copying itself into other files, while spyware is built to quietly collect information. Both are types of malware.

Conclusion

Spyware is hidden by design, so the best defence is to know the warning signs, check your devices regularly and keep software updated. If you suspect an infection, scan the device, remove suspicious apps and permissions, secure your accounts from a clean device and restore the device if needed. Consistent habits, such as downloading only from trusted sources and using strong, unique passwords with two-factor authentication, prevent most spyware infections before they start.