Spyware is malicious software that covertly monitors a device and its user and transmits the collected information to a third party without informed consent. Depending on its design, spyware may capture keystrokes, screenshots, browsing history, messages, location, microphone audio or stored credentials, and it typically works hard to stay invisible to the person being watched.
Within malware & attacks, spyware is defined by its purpose of surveillance rather than by how it spreads. It can arrive through a Trojan, a phishing attachment, a malicious app, a bundled installer or a remote exploit chain. What unites all variants is the goal of persistent, silent data collection, which distinguishes spyware from ransomware, whose goal is loud extortion.
How spyware collects and exfiltrates data
Spyware operates in three stages: installation, collection and exfiltration. After gaining a foothold, it establishes persistence through startup entries, services, scheduled tasks, browser extensions or device administrator privileges, so that it survives reboots.
Collection relies on legitimate operating system interfaces used for illegitimate ends: keyboard hooks, accessibility services on mobile devices, screen capture APIs, browser databases and notification listeners. Exfiltration then sends the data to a command-and-control server, often batched, compressed, encrypted and disguised as ordinary HTTPS traffic to avoid notice.
The table summarizes common collection techniques and the data each one exposes.
| Technique | Data exposed | Typical platform |
|---|---|---|
| Keystroke logging | Passwords, messages, search terms | Desktop and mobile |
| Screen capture | Anything displayed, including documents | Desktop |
| Accessibility abuse | On-screen content and app interactions | Android |
| Browser data theft | History, cookies, saved passwords | Desktop browsers |
| Microphone and camera access | Conversations and surroundings | Mobile and laptops |
| Location tracking | GPS position and movement patterns | Mobile |
Types of spyware
The spyware category spans a wide range, from nuisance tracking software to state-grade surveillance tools. The level of sophistication usually matches the value of the target.
| Type | Typical operator | Typical target | Sophistication |
|---|---|---|---|
| Tracking adware | Advertising networks | General consumers | Low |
| Stalkerware | Partners or family members | Individual phones | Low to medium |
| Infostealer | Criminal groups | Credentials at scale | Medium |
| Banking spyware | Organized fraud groups | Online banking users | Medium to high |
| Commercial mercenary spyware | Government customers | Journalists, officials, activists | Very high |
Stalkerware deserves special mention because it is usually installed by someone with physical access to the phone, such as an abusive partner. Commercial mercenary spyware sits at the opposite extreme: sold to governments, it may use zero-click exploit chains that compromise a phone through a message the victim never opens.
Spyware compared with related malware
Spyware overlaps with several neighboring categories in malware & attacks, and a single sample can belong to more than one. The distinction lies in the primary function of each category.
| Category | Primary function | Relation to spyware |
|---|---|---|
| Keylogger | Records keystrokes | A specific spyware capability |
| Infostealer | Harvests credentials and files quickly | Spyware focused on fast theft |
| Trojan | Disguises itself as legitimate software | A common delivery method |
| Rootkit | Hides malicious activity in the system | Used to conceal spyware |
| Adware | Shows or injects advertisements | Often includes tracking features |
| Ransomware | Encrypts data for extortion | Opposite goal: visibility and payment |
An infostealer usually grabs credentials and session cookies in one pass and may even remove itself, while classic spyware remains on the device to watch over time. Both lead to account takeover, which is why stolen session cookies can bypass multi-factor authentication.
Where monitoring software becomes spyware
The same technical capabilities appear in legitimate monitoring products, so the line between a tool and spyware is drawn by consent, disclosure and ownership rather than by code. Corporate device management, parental controls and employee monitoring software can all record activity, yet they are lawful in many jurisdictions when the device owner deploys them openly and within applicable privacy and labor rules.
The same software becomes spyware when it is installed secretly on a device the installer does not own, hides its icon, or collects more than the stated purpose requires. Security vendors therefore increasingly detect stalkerware by behavior regardless of how it is marketed, and many legal systems treat covert interception of communications as a criminal offense.
Signs of infection and detection methods
Well-built spyware leaves few visible symptoms, so detection depends more on systematic checks than on user observation. Battery drain or heat may appear on phones, but modern variants are careful to stay quiet.
- Unknown apps with accessibility or device administrator rights on Android are a strong warning sign.
- Unfamiliar configuration profiles on iOS or macOS can enable traffic interception.
- Unexpected browser extensions with broad permissions may log browsing and form input.
- Network traffic to unusual destinations at regular intervals can reveal exfiltration.
- Endpoint detection and response alerts for credential store access or screen capture by unknown processes.
Advanced mobile spyware is often found only through forensic analysis of device backups and logs by specialized tools, because it may run in memory and leave minimal traces.
Prevention and response
Defense against spyware combines reducing the paths of entry with limiting what an infection can reach. The table matches common entry routes with effective countermeasures.
| Entry route | Countermeasure | Effect |
|---|---|---|
| Malicious apps | Install only from official stores, review permissions | Blocks most consumer spyware |
| Phishing attachments | Email filtering and user training | Reduces initial infection |
| Physical access to a phone | Strong passcode and biometric lock | Prevents stalkerware installation |
| Unpatched exploits | Prompt operating system updates | Closes zero-click and browser flaws |
| Stolen credentials | Phishing-resistant MFA such as passkeys | Limits damage of captured passwords |
Once spyware is confirmed, assume every secret on the device is compromised. The safe response is to isolate the device, reset it or reinstall from trusted media, change passwords from a clean device and revoke active sessions. For people at elevated risk, features such as Lockdown Mode on Apple devices reduce the attack surface used by mercenary spyware.
The idea in brief
Spyware is a hidden watcher inside your device. It does not break anything or demand money. It quietly records what you type, see or say and sends it to someone else.
Because it tries to stay invisible, you may never notice it. Keeping your device updated, installing apps only from trusted sources and locking your phone are the simplest ways to keep it out.
A practical scenario
An accountant at a mid-sized firm downloads what looks like a free PDF converter from a search advertisement. The installer works as promised but also adds a browser extension and a background process that capture form input and copy saved browser passwords every few hours.
Two weeks later the company’s endpoint detection tool flags an unknown process reading the browser’s credential database and sending small encrypted uploads to a newly registered domain. The security team isolates the laptop, reinstalls it, resets the accountant’s passwords and revokes cloud sessions. Reviewing logs, they find that the stolen banking portal credentials were never used because the portal required a hardware security key, so the infection ended without financial loss.