Commercial spyware has never been easier to install — or harder to detect. Apps like mSpy, FlexiSpy, and dozens of lesser-known clones can be loaded onto a phone in under two minutes, and once running, they operate invisibly. They record calls, read texts, track GPS locations, copy photos, log keystrokes, and silently transmit everything to whoever installed them. In 2025 alone, the FTC reported a 340% increase in stalkerware complaints compared to 2020.
The problem is that spyware is designed to stay hidden. You won't find it in your normal app list. It won't show a notification. But it can't hide its side effects. These seven warning signs indicate that your phone may be compromised — and each one tells you exactly what to do about it.
The 7 Warning Signs
Unexplained Battery Drain
Your phone used to last a full day. Now it's dead by 3pm, even though you haven't changed how you use it. The battery percentage drops visibly while the phone sits untouched on a table.
Spyware runs constantly in the background — recording audio, capturing screenshots, logging keystrokes, and transmitting data to a remote server. All of that requires processing power, which drains the battery far faster than normal use. Unlike legitimate background apps, spyware can't be throttled by your phone's battery optimization because it uses techniques to stay persistently active.
Check your battery usage breakdown. On iPhone: Settings → Battery → scroll to see per-app usage. On Android: Settings → Battery → Battery Usage. Look for apps consuming disproportionate power — especially anything you don't recognize or didn't install. If "System Services" or a vaguely named process is consuming 20%+ of battery, that's a red flag worth investigating further.
Unusual Data Usage Spikes
Your monthly data consumption has jumped significantly — sometimes by gigabytes — without any change in your habits. You're not streaming more, downloading more, or using new apps, but the numbers don't lie.
Spyware needs to transmit everything it captures — call recordings, message logs, photos, location data, and sometimes live audio feeds — back to a remote server. This exfiltration happens over your mobile data or Wi-Fi connection. Some advanced spyware batches the data and transmits at scheduled intervals to avoid detection, but the total volume always shows up in your data usage stats.
Review per-app data usage. iPhone: Settings → Cellular → scroll to per-app data. Android: Settings → Network → Data Usage → App Data Usage. Reset statistics monthly so anomalies are easier to spot. If an app you barely use — or one you don't recognize at all — is consuming hundreds of megabytes, investigate it immediately. Cross-reference the app name with known spyware indicators.
Phone Overheats for No Reason
Your phone feels warm or hot to the touch even when you're not using it, or when you're only doing light tasks like reading email. The heat is especially noticeable when the phone has been sitting idle — in your pocket, on a nightstand, or charging.
Processing power generates heat. When spyware continuously runs in the background — recording ambient audio, tracking your location via GPS, or encrypting and uploading captured data — the CPU stays active even when the screen is off. This sustained background processing causes the device to heat up well beyond what idle mode should produce.
Close all apps and let your phone sit idle for 15 minutes. If it's still noticeably warm, something is running that shouldn't be. Restart in Safe Mode (Android: hold Power → long-press "Power Off" → tap "Safe Mode"; iPhone doesn't have Safe Mode, but you can check Settings → General → iPhone Storage for unfamiliar apps). In Safe Mode, only built-in apps run — if the overheating stops, a third-party app is the cause.
Background Noise on Calls
You hear static, clicking, faint buzzing, or distant echoes during phone calls that weren't there before. Sometimes you'll hear a brief beep or tone at the start of a call. People on the other end might also mention hearing strange sounds or feedback.
Call-recording spyware intercepts your phone's audio pipeline to capture both sides of the conversation. This interception can introduce artifacts — particularly on older networks or when the spyware's recording codec conflicts with the call's audio stream. Some stalkerware apps also enable the microphone outside of calls (ambient listening), which can briefly interfere with call audio when both functions overlap.
Test calls on different networks (Wi-Fi calling vs. cellular) and to different contacts. If the noise persists regardless of who you're calling or which network you're on, the issue is on your device, not the network. Check for any call-recording or voice-memo apps you didn't install. On Android, review Settings → Apps → All Apps and sort by recently installed. On iPhone, check Settings → General → iPhone Storage and look for anything unfamiliar.
Sluggish Performance
Apps take longer to open. Swiping between screens stutters. Typing lags behind your fingers. Your phone freezes momentarily during basic tasks it used to handle instantly. It feels like the phone aged two years overnight.
Spyware competes with your legitimate apps for CPU, RAM, and storage I/O. When it's actively capturing data — taking screenshots, logging inputs, processing audio — it consumes resources your phone needs for normal operation. Some spyware also writes extensively to local storage before uploading, which further degrades performance, especially on phones with limited remaining storage.
First rule out the obvious: check available storage (low storage always causes slowdowns) and restart your phone. If performance doesn't improve, check which processes are consuming the most resources. Android: Settings → Developer Options → Running Services shows active background processes. iPhone: there's no direct equivalent, but you can check battery usage (Settings → Battery) for apps consuming disproportionate CPU time — anything in the 20%+ range that you don't actively use warrants investigation.
Unfamiliar Apps You Didn't Install
An app appears on your phone that you have no memory of downloading. It might have a generic name like "System Service," "Phone Monitor," "Backup Utility," or even just an icon with no label. Sometimes it only appears in your installed-apps list, not on your home screen.
Most commercial spyware installs as a standalone app but hides its icon from the home screen and app drawer. However, it still appears in the full installed-apps list in your phone's settings. Some spyware disguises itself with legitimate-sounding names to avoid suspicion if you do find it. On Android, sideloaded apps (installed outside the Play Store) are a particularly common vector — someone with brief physical access to your phone can install them in minutes.
Audit your full app list regularly. On Android: Settings → Apps → All Apps. On iPhone: Settings → General → iPhone Storage. Look for anything you didn't install, don't recognize, or that has no icon. Google any suspicious app names — stalkerware databases like those maintained by the Coalition Against Stalkerware catalog known spyware names. If you find something suspicious, don't uninstall it yet. Document it first (screenshot, note the name) in case you need evidence later. Then remove it.
If you suspect stalkerware installed by someone you know (a partner, family member, or employer), preservation of evidence matters. Screenshot the app, note its permissions, and check when it was installed before removing it. This information may be critical if you pursue legal action. Stalkerware installation without consent is illegal in most jurisdictions.
Unexpected Texts, Emails, or Account Activity
You receive two-factor authentication codes you didn't request. Password reset emails arrive for accounts you didn't try to access. Contacts tell you they received messages from you that you didn't send. Your email shows "sent" messages you never wrote. Login notifications come from devices or locations you don't recognize.
Once spyware has access to your messages and email, attackers can intercept 2FA codes and use them to access your accounts in real time. Some spyware also allows the controller to send messages from your phone, manipulate your accounts, or use your identity for social engineering attacks against your contacts. Unrequested 2FA codes are particularly telling — they mean someone already has your password and is actively trying to log in.
Treat unrequested 2FA codes as an active attack. Change your passwords immediately, starting with email (it's the recovery method for everything else). Switch to an authenticator app instead of SMS-based 2FA — if your phone is compromised, SMS codes are intercepted before you see them. Review active sessions on all critical accounts (Gmail, banking, social media) and sign out unrecognized devices. Then run a breach check to see if your credentials were leaked in a data breach, which would explain how the attacker got your password in the first place.
What to Do Next
If two or more of these signs apply to your phone right now, treat it as a probable compromise — not a coincidence. Here's your immediate action plan:
1. Run a breach scan. Before touching your phone's settings, find out if your email and credentials were already exposed in a data breach. Attackers who buy leaked credentials from data breaches often install spyware as a second step to maintain persistent access. SkullSnare shows you exactly which breaches contain your data, what was exposed, and your current risk level.
2. Update your operating system. Many spyware apps exploit known vulnerabilities that have already been patched. Updating to the latest iOS or Android version can break the spyware's access and close the holes it used to install itself.
3. Factory reset as a last resort. If you can't identify or remove the spyware, a factory reset wipes everything — including any hidden surveillance tools. Back up your photos and contacts to a clean cloud account first, but do not restore from a backup that might include the spyware. Set up the phone fresh.
4. Change all passwords from a different device. If your phone is compromised, any password you type on it is captured. Use a trusted computer to change passwords for email, banking, social media, and any account with financial access. Enable two-factor authentication using an authenticator app (not SMS) on every account.
Check if your phone has been compromised.
SkullSnare scans your breach history and shows you exactly what data has been exposed — every account, every leak, with a risk score and evidence report.
Run Your Scan — $20