Your Android phone could have stalkerware, here’s how to remove it

A security vulnerability in one of the biggest consumer-grade spyware operations today is putting at risk the private phone data of about 400,000 people, a number that’s growing daily. The operation, identified by TechCrunch, is run by a small crew of developers in Vietnam but has yet to fix the security issue.

In this case it isn’t just one problematic spyware app. It’s an entire fleet of apps — Copy9, MxSpy, TheTruthSpy, iSpyoo, SecondClone, TheSpyApp, ExactSpy, FoneTracker and GuestSpy — that share the same security vulnerability.

But without a fix in place, TechCrunch cannot reveal specific details about the vulnerability because of the risk it poses to the hundreds of thousands of people whose phones have been unknowingly compromised.

With no expectation that the vulnerability will be fixed any time soon, this guide can help you remove these specific spyware apps from your Android phone — if you believe it’s safe to do so.

Consumer-grade spyware apps are often sold under the guise of child tracking software but are also known as “stalkerware” for their ability to track and monitor partners or spouses without their consent. These apps are downloaded from outside of Google Play’s app store, planted on a phone without a person’s permission, and are designed to disappear from the home screen to avoid detection. You may notice your phone acting unusually, or running warmer or slower than usual, even when you are not actively using it.

Because this fleet of stalkerware apps relies on abusing in-built Android features that are more commonly used by employers to remotely manage their employee’s work phones, checking to see if your Android device is compromised can be done quickly and easily.

Before you proceed, have a safety plan in place. The Coalition Against Stalkerware offers advice and guidance for victims and survivors of stalkerware. Spyware is designed to be covert, but keep in mind that removing the spyware from your phone will likely alert the person who planted it, which could create an unsafe situation.

Note that this guide only removes the spyware app, it does not delete the data that was already collected and uploaded to its servers. Also, some versions of Android may have slightly different menu options. Follow these steps at your own risk.

Check your Google Play Protect settings

Make sure Google Play Protect, a security feature in Android phones, is enabled. Image Credits: TechCrunch

Google Play Protect is one of the best safeguards to protect against malicious Android apps, both third-party and in the app store. But when switched off, those protections stop, and stalkerware or malware can be installed on the device outside of Google Play. That’s why this stalkerware network asks the person who plants the spyware to disable Google Play Protect before it works.

Check your Google Play Protect settings through the Google Play app and make sure it’s enabled, and that a scan has been recently completed.

Check if accessibility services have been tampered with

Stalkerware relies on deep access to your device and its data, and it often abuses the accessibility feature in Android which, by design, has to have wide access to the operating system and its data in order for the screen reader and other accessibility features to work. If you do not recognize a downloaded service in the Accessibility options, you may want to remove it. Many of the stalkerware apps are disguised as plain apps called “Accessibility” or “Device Health.”

Android spyware often abuses in-built accessibility features. Image Credits: TechCrunch

Check if a device admin app has been installed

Device admin options have similar but even broader access to Android as the accessibility features. These device admin options are designed to be used by companies to remotely manage their employees’ phones, disable features and wipe data to prevent data loss. But they also allow stalkerware apps to record the screen and snoop on the device owner.

An unrecognized item in your device admin app settings is a common indicator of phone compromise. Image Credits: TechCrunch

Most people won’t have a device admin app on their personal phone, so be aware if you see an app you don’t recognize, named something like “System Service,” “Device Health,” or “Device Admin.”

Check apps to uninstall

You may not see a home screen icon for any of these stalkerware apps, but they may still appear in your Android device’s app list. Go to your Android settings, then view your apps. Look for an innocuously named app like “Device Health” or “System Service,” with generic-looking icons. These apps will have broad access to your calendar, call logs, camera, contacts and location.

Spyware apps often have generic-looking icons. Image Credits: TechCrunch

If you see an app here that you don’t recognize or haven’t installed, you can hit Uninstall. Note that this will likely alert the person who planted the stalkerware that the app is no longer installed.

Secure your phone

If stalkerware was planted on your phone, there is a good chance that your phone was unlocked, unprotected or that your screen lock was guessed or learned. A stronger lock screen password can be helpful to protect your phone from would-be stalkers. You should also protect email and other online accounts using two-factor authentication wherever possible.

If you or someone you know needs help, the National Domestic Violence Hotline (1-800-799-7233) provides 24/7 free, confidential support to victims of domestic abuse and violence. If you are in an emergency situation, call 911. The Coalition Against Stalkerware also has resources if you think your phone has been compromised by spyware. You can contact this reporter on Signal and WhatsApp at +1 646-755-8849 or zack.whittaker@techcrunch.com by email.

Behind the stalkerware network spilling the private phone data of hundreds of thousands