How to Detect, Remove and Prevent Spyware

What “spyware” means in 2026

Spyware is software that collects information or observes activity without informed permission. The label covers several different problems: a keylogger capturing passwords, an infostealer taking browser cookies, a browser hijacker redirecting searches, a malicious extension reading pages, a remote-access tool used without consent, or a mobile monitoring app reporting location, messages and calls.

Stalkerware is the personal-surveillance form of this problem. It's commonly installed by someone who can physically handle an unlocked phone or knows its passcode. The technical cleanup may be simple; the human risk may not be. The FTC’s stalkerware guidance says to consider safety planning before removal because a person who loses access may escalate their behavior.

Modern antivirus and anti-malware products generally overlap. “Anti-spyware” is now more useful as a capability than as a separate product category. A good primary security tool should detect broad malware families, potentially unwanted programs and suspicious behavior; a compatible on-demand scanner can provide a second opinion. Our commercial shortlist lives on the separate best anti-spyware software page. This guide is about response, not rankings.

Spyware signs are clues, not a diagnosis

Unexpected battery drain, heat, data use, freezes or crashes can come from a normal software update, a degraded battery, weak cellular coverage or a badly written legitimate app. Pop-ups may be a website notification rather than installed malware. One symptom isn't enough to identify spyware.

The strongest evidence is a combination: an unknown high-privilege app plus disabled Play Protect, an unfamiliar MDM profile plus unexplained account access, or a scanner detection that names a file and threat family. Record the app name, publisher, path, permissions, detection name and time before making irreversible changes—if collecting that evidence is safe.

What to do first when compromise is plausible

1. Move sensitive communication to a safer device. Don't change every password on a device that may be recording keystrokes or sessions.
2. Decide whether this is a personal-safety case. If a partner, ex-partner or family member may be monitoring you, use a trusted phone or computer to seek support and build a safety plan first.
3. Preserve useful evidence. Photograph or record detections, unknown apps/profiles, account sessions and sharing settings. Don't handle suspected criminal evidence more than necessary.
4. Contain active theft. If you see live fraudulent transactions or business-data access, contact the bank or employer immediately. Disconnect a computer from networks if active exfiltration is likely, but understand that going offline can alert a monitor.
5. Update before scanning where practical. Install current OS and security definitions from official update mechanisms. Don't download a “cleaner” from a pop-up.
6. Scan and remove using the platform sequence below. Record what was quarantined. Avoid manually deleting random system files or registry entries.
7. Recover accounts from the clean device. Revoke sessions, fix recovery details, change unique passwords and enable phishing-resistant MFA where available.
8. Monitor and escalate. Persistent detections, privileged business compromise, targeted commercial spyware or renewed access after cleanup warrants professional incident response or a clean reset/reinstall.

The safe removal sequence

Don't begin by installing three always-on antivirus products. Real-time engines can conflict, generate noise and make troubleshooting harder. Start with the platform’s built-in protection or one reputable primary security suite, then use one compatible on-demand second opinion if the result is unclear.

If the same threat returns, protection can't stay enabled, administrator controls are unexplained, or the scanner can't finish, stop improvising. Back up irreplaceable documents without copying programs, then use an official recovery path or a qualified technician. For a business device, follow the organization’s incident-response process instead of wiping evidence yourself.

How to remove spyware from Windows 11 or 10

1. Open Windows Security → Virus & threat protection → Protection updates and check for updates.
2. Under Scan options, run a Full scan. Review each detection name and affected path before allowing or restoring anything.
3. If malware returns or appears to hide while Windows runs, save your work and use Microsoft Defender Offline scan. Microsoft explains that it restarts into a trusted environment so persistent threats have less opportunity to conceal themselves; follow the current Defender malware-removal procedure.
4. Remove unknown browser extensions, reset unauthorized search/homepage changes and review Settings → Apps → Installed apps. Don't uninstall a program solely because its name is unfamiliar—verify the publisher and installation context.
5. Check that real-time protection, cloud-delivered protection and tamper protection are active. Investigate exclusions you didn't create.
6. Restart and scan again. If detections or redirects return, use a reputable on-demand second opinion or back up documents and perform an official clean Windows reinstall.

The Windows Malicious Software Removal Tool isn't a full anti-spyware solution. Microsoft says it removes specific prevalent threats and separately recommends Defender Offline or Microsoft Safety Scanner for broader detection. Likewise, old instructions built around ComboFix, HijackThis or random registry deletion are inappropriate for a general consumer guide: a mistaken change can make Windows unbootable while leaving account compromise untouched.

How to check and clean a Mac

macOS already includes Gatekeeper, Notarization and XProtect. Apple’s current macOS malware-protection documentation says XProtect receives signatures independently from normal system updates and can block or remediate known malware. That doesn't make every Mac immune or prove that an unexpected prompt is harmless.

1. Install macOS updates and restart. Don't bypass a Gatekeeper warning merely because a website tells you to.
2. Review System Settings → General → Login Items & Extensions. Remove only items you can identify as unwanted.
3. Review browser extensions, notification permissions and search settings. Many “Mac virus” pop-ups are browser notifications or scareware pages, not system detections.
4. Check Privacy & Security permissions for Accessibility, Screen & System Audio Recording, Full Disk Access, Camera, Microphone and Location. An unknown app with several of these deserves investigation.
5. On a managed or previously managed Mac, review device-management profiles in System Settings. Don't remove an employer/school profile from their device without authorization.
6. Run one reputable Mac security scanner if symptoms or permissions remain suspicious. If persistence returns after removal, preserve evidence and consider a clean erase/reinstall or professional help.

How to detect and remove spyware on Android

Menu names vary by phone maker, but the investigation targets are consistent: installed apps, Accessibility services, device-admin apps, notification access, VPNs, “install unknown apps,” battery/data use and Google-account sessions. A hidden launcher icon doesn't hide an app from the full Settings app list.

1. Open the Play Store, tap the profile icon, choose Google Play Protect and run a scan. Keep “Scan apps with Play Protect” enabled. Google says Play Protect checks installed apps periodically and can warn, disable or remove potentially harmful apps.
2. Review all installed apps—not only the home screen. Sort by recently installed or last used if the phone supports it. Verify unfamiliar package names before removal.
3. Review special access: Accessibility, Device admin apps, Notification access, Usage access, Display over other apps, VPN and install-unknown-apps permission. Stalkerware may rely on one or more of these.
4. If an unwanted app can't be uninstalled, first revoke its Device admin or Accessibility privilege, then uninstall it. Capture evidence before this step when safety or a police report may matter.
5. Update Android and apps, restart and scan again. Review Google Account → Security → Your devices, recent security activity, third-party connections and recovery options from a clean device.
6. If monitoring persists, use the manufacturer’s official factory-reset process. Reinstall apps manually from trusted sources instead of restoring every old APK or device setting.

Deleting stalkerware stops future collection only if removal succeeds. It can't retrieve copies already uploaded to someone else’s dashboard. That's why account/session recovery, safety planning and a new device PIN unknown to the other person are part of the cleanup.

What anti-spyware can and can't do on iPhone

An ordinary iPhone security app doesn't receive desktop-style access to scan every other app or all of iOS. Many products sold as “iPhone antivirus” mainly provide malicious-site blocking, breach alerts, VPN or identity features. For most people, the useful checks are iOS updates, Apple Account access, sharing, permissions, profiles and signs of jailbreak or highly targeted compromise.

1. Install the latest iOS update available for the device. Remove apps you don't recognize after recording their details.
2. Open Settings → Privacy & Security → Safety Check on iOS 16 or later. Apple’s Safety Check guide explains how Manage Sharing & Access reviews people/apps individually and Emergency Reset quickly stops sharing. Consider personal-safety consequences before using either.
3. Tap your name in Settings and inspect devices signed in to the Apple Account. Remove devices you don't own, correct trusted phone numbers/recovery contacts and change the account password from a safe device.
4. Review Location Services, Camera, Microphone, Photos, Contacts, Bluetooth and Local Network permissions. Check Settings → General → VPN & Device Management for an unknown VPN or management profile.
5. Investigate an unexpected jailbreak, repeated Apple threat notifications or credible evidence of targeted commercial spyware with Apple Support or a specialist. Lockdown Mode is an extreme optional protection for the small number of people targeted by sophisticated attacks, not a routine malware scanner.
6. When evidence persists, preserve what you need and erase the iPhone through Apple’s official process. Set it up as new where feasible; restoring all settings can reintroduce unwanted configuration even when the operating system itself is clean.

Device cleanup is only half the response

Infostealers target browser sessions, saved passwords and authentication tokens. Stalkerware may expose messages before it's removed. A clean scan therefore doesn't prove that cloud accounts are safe.

• From a clean device, start with primary email, Apple/Google/Microsoft account, password manager, banking and work accounts.
• Sign out other sessions and remove unknown devices, app passwords, API access and third-party connections.
• Replace reused passwords with unique passwords; don't merely add one character.
• Correct recovery email addresses, phone numbers, forwarding rules and mailbox delegates.
• Enable MFA. Prefer a security key or passkey where the service supports it; protect the mobile carrier account with a PIN.
• Review payment activity, credit alerts, cloud-sharing links and family/location sharing.
• Monitor for renewed access. A second incident may mean an unrecovered account or person with physical access, not necessarily surviving malware.

How to choose a legitimate anti-spyware scanner

For current product comparisons, read our anti-spyware shortlist, best antivirus guide and Android security guide. A product can be a useful second-opinion scanner without being the best choice for always-on protection.

Prevent spyware and stalkerware from returning

• Keep the operating system, browser and apps on automatic updates.
• Use a device PIN/passcode the other person doesn't know; disable lock-screen notification previews if privacy requires it.
• Install software only from the vendor’s official site or the platform store, and keep Play Protect enabled on Android.
• Review extensions, high-risk permissions, login items, device administrators and management profiles quarterly.
• Use unique passwords in a password manager and enable MFA; review active sessions after a relationship, job or device ownership changes.
• Don't grant Accessibility, Full Disk Access, Screen Recording or Device Admin just to make an unsolicited “cleaner” work.
• Keep offline or versioned backups of important files. Test that recovery works before an incident.
• For family or employee monitoring, use transparent tools, informed consent and the least access needed—never a hidden consumer surveillance app.

Anti-spyware FAQ