Spyware

Definition

Spyware is a program installed without the user's knowledge to observe their activity — pages visited, messages, credentials, location — and transmit it to a third party. This entry covers the case where that third party is a stranger acting remotely. When the installation is carried out by someone close to the victim with physical access to the device, it is stalkerware, which calls for a different course of action that accounts for the danger that person poses.

How it works

Installation follows the usual routes: a trojan program, a browser extension, an app from outside the official store, sometimes a component bundled into otherwise legitimate software. Once in place, the program is built for endurance rather than immediate payoff: it uses few resources, changes nothing visible, and restarts at boot. What it collects depends on the permissions it obtained — browsing history and keystrokes, messaging content, location, microphone and camera on a phone. The difficulty for the targeted person is structural: the only symptom of spyware working well is that there is none.

Warning signs

• Battery draining noticeably faster than before, with no change in use
• Unexplained rise in mobile data consumption
• Device warm at rest, or slow when nothing seems to be running
• Unknown app in the list, or access granted to functions unrelated to its purpose
• On a phone, a microphone or camera indicator lighting up outside of use
• No sign at all — which rules nothing out

How to verify

Review the list of installed apps and extensions, and the permissions granted to each: an app whose purpose has nothing to do with the microphone, location or accessibility features, yet has access to them, is the most useful signal. Check the devices connected to your main accounts from another device. But know what this check is worth: it catches what didn't try to hide, and a program designed to stay hidden won't show up this way.

What to do

Only install from official stores and publishers' sites, and refuse permissions an app doesn't justify through its function. Keep the system updated: that's what closes off silent-installation paths.

If it already happened

From another device, change the passwords of your main accounts and check open sessions. On the suspect device, resetting the system to factory settings is the only measure you can vouch for — removing a spotted app doesn't prove it was the only one. Don't restore a backup made before the suspicion arose without having it examined, or you risk reinstalling what you just removed. Report the incident to cybermalveillance.gouv.fr. If you suspect someone close to you is behind the surveillance, don't change anything right away and read the stalkerware entry first: acting on the device is visible to the person watching.

Frequently asked questions

What's the exact difference with stalkerware?

The technique is the same, the context is reversed. Spyware comes from a stranger after your data; stalkerware comes from someone close to you who is watching you, and who is physically present. The practical consequence: in the second case, removing the app can be noticed and put the person under surveillance at risk, which completely changes the order of steps to take.

Does antivirus software detect spyware?

It detects what it knows. A detection is therefore useful information, but a lack of detection proves nothing — that's true of any check run from the machine under suspicion.

Is resetting my phone enough?

The reset erases what's installed, but restoring a backup made before that can bring the app back. If you reset, start fresh for apps, recovering only your documents.

Related attacks

• Stalkerware (surveillance by someone close to you)
• Keylogger
• Trojan Horse
• Excessive permissions
• Infostealer (credential-stealing malware)
• Malicious app
• Computer Virus
• Rootkit

Official sources

• Cybermalveillance.gouv.fr — Assistance and reporting (French government cybersecurity assistance service)