What is spyware and how to remove it

What is spyware?

Spyware is software that watches what you do on a computer or phone and passes it to someone else without your clear consent. The someone can be a criminal gang, an advertiser, a jealous partner or, in rare cases, a government. What they want differs. The method is the same: quiet collection, then upload.

Microsoft's rule for software that stores or sends out your data is simple. It must tell you and get your consent, and it must not offer an option to hide that activity ^[1]. Spyware breaks exactly that rule. Microsoft also describes password stealers, which gather usernames and passwords and often work with a keylogger that records the keys you press and the sites you visit ^[1].

So spyware is less one kind of program than a goal. A trojan that steals your browser passwords is spyware. A phone app that forwards your messages to an ex is spyware. An extension that logs every site you open and sells the list is a mild form of it. This page covers all of them, and the spyware guides below it cover single names.

Is spyware a virus or malware?

Spyware is malware in most cases, but it is usually not a virus. A virus copies itself into other files. Spyware rarely spreads on its own. It arrives once, through one click or one person with access, and then stays hidden for as long as it can.

The label you see in a scanner depends on the product and on how the spyware behaves. Password stealers and remote access tools get malware names such as PWS, Stealer, Spy or Keylogger. Commercial monitoring apps are often flagged as stalkerware, monitor or riskware, because the seller presents them as a legal product. Tracking adware usually sits lower, under potentially unwanted apps. Our page on antivirus detection names explains how to read these labels.

Types of spyware and real examples

Info stealers

These are the spyware most people actually get today. A stealer runs once, copies saved browser passwords, session cookies and wallet files, sends them out and often deletes itself. Families like RedLine, Lumma and Vidar are sold as a service to anyone who pays. Our info stealers guide covers the families, how fast they work and what to do in which order.

Keyloggers

A keylogger records what you type. Some are part of a stealer or a trojan. Others are sold openly as monitoring programs for parents or employers and then misused on someone else's PC. Perfect Keylogger and Ardamax Keylogger are two of the commercial ones readers search for most. The keyloggers section lists the rest.

Stalkerware and phone spy apps

The Coalition Against Stalkerware defines stalkerware as apps, programs and devices that let another person, often a partner or family member, secretly monitor someone's phone activity ^[6]. It is sold to anyone. The person who installs it needs no technical skill ^[6].

Kaspersky says these products are usually marketed as anti-theft or parental control apps ^[7]. Common features include hiding the app icon, reading SMS and call logs, tracking location, reading chats in messengers and social apps, viewing photos and taking pictures with the front camera ^[7]. Spyzie is one example we cover in depth.

In 2023 Kaspersky counted 31,031 of its mobile users affected by stalkerware, up from 29,312 in 2022, across 175 countries ^[7]. Those are only the people who ran Kaspersky's app, so the real number is higher ^[7].

Spyware hidden in normal-looking apps

Some phone spyware poses as a game, a messenger or a tool and spreads through app stores or fake download sites. Cases we covered include fake Telegram and Threema apps, a fake TikTok Pro app that stole passwords, and KoSpy, Android spyware linked to the North Korean group APT37.

Tracking adware and data-collecting extensions

This is the mildest type. Microsoft calls software that monitors your activity and sends it to other services for marketing research "marketing software" ^[1]. In practice it is a coupon or search extension that logs every page you open. The adware guide and our list of malicious browser extensions cover it.

Mercenary spyware: Pegasus, Predator and similar tools

Pegasus, made by NSO Group, is the name most people know. Apple says attacks of this kind cost millions of dollars, are aimed at a very small number of people, and have historically been tied to state actors and the private companies that build tools for them ^[4]. Targets are often journalists, activists, politicians and diplomats ^[4].

Here is the honest part for ordinary users. Apple states that the vast majority of users will never be targeted by such attacks ^[4]. If you are not in one of those groups, Pegasus is very unlikely to be on your phone. Where you are more likely to meet the name is in scams. The "Have you heard about Pegasus" email and the "PEGASUS SPYWARE ACTIVATED" pop-up both use the name to frighten people into paying. Predator, sold by the Intellexa group, works in a similar way and has a similar target list.

What spyware collects

What leaves your device depends on the type, but these are the items we see again and again in our guides and in vendor reports.

• Saved passwords and autofill data from Chrome, Edge, Firefox and other browsers.
• Session cookies. These let an attacker open your email or social account as if already signed in, which can get past two-step verification until the session ends.
• Keystrokes, which catch passwords you never saved, card numbers and private messages ^[1].
• Messages, call logs, contacts, photos and location on phones ^[7].
• Screenshots, and on some tools the camera and microphone ^[7].
• Crypto wallet files and browser wallet extensions.
• Files from the desktop and documents folders, such as scans of IDs.
• Browsing history and search terms, which tracking adware sells ^[1].

Stolen logins feed account takeovers, fraud and new phishing sent from your own address. Our password and data theft topic collects the guides on what happens next.

How spyware gets on your computer or phone

Spyware enters in different ways on computers and on phones. Knowing which one fits your situation tells you where to look.

On Windows and Mac

1. Cracked software, keygens and game cheats. This is the main route for info stealers. The FTC advises against downloading free software from unfamiliar sites and peer-to-peer networks ^[2].
2. Fake download sites and search ads. Criminals buy ads for popular apps and send you to a lookalike page ^[2].
3. Fake captcha and "fix it" pages. A page tells you to paste a command into Run or Terminal. Our ClickFix guide shows how that works.
4. Phishing attachments and links that pose as invoices, parcels or shared documents.
5. Bundled installers and extensions, for tracking adware.
6. Someone with access to your computer who installs a keylogger or monitoring program by hand.

On Android and iPhone

Stalkerware usually needs someone to hold your phone and get past its lock screen ^[6]. That is why it is so often a partner, an ex or a family member. On Android, the person installs an app from outside the Play Store, grants it wide permissions and hides the icon. Kaspersky notes that stalkerware is much rarer on iPhone, because a full spy app needs a jailbroken device and physical access ^[7].

iPhone spying more often goes through the account rather than the phone. The Coalition Against Stalkerware notes that some iPhone stalkerware pulls data from iCloud backups, so someone who knows your Apple Account password can read your data without touching the phone again ^[6]. Fake apps from links in messages are the other common route on Android.

Signs of spyware: what you can and cannot see

Be ready for this: spyware is designed to show nothing. Lists of signs online promise more than they can deliver. The Coalition Against Stalkerware says a fast-draining battery, data spikes and strange notifications may be signs, but some stalkerware runs with no such side effects ^[6].

The Coalition's advice is to trust your instincts, because the most common sign of phone monitoring is the abuser's own behaviour ^[6]. Keeping a short written log of what you notice helps you spot patterns, and it helps if you go to the police or a support service later ^[6]. A scan is still the most direct check you have. Our link and file check can help with a suspicious download or address.

Is spyware dangerous?

Yes. Spyware is one of the more serious threats you can meet, because the harm continues after the program is gone. A stealer that ran for ten seconds may already have sent every saved password you had.

• Money. Stolen card details, bank logins and crypto wallets are emptied or sold.
• Accounts. Email, social media and gaming accounts are taken over and used to scam your contacts.
• Personal safety. Stalkerware gives an abuser your location and private messages. Kaspersky describes it as one part of tech-enabled abuse, often used in abusive relationships ^[7].
• Blackmail. Screenshots, photos and chats can be used for extortion.
• More malware. Many stealers and trojans download other tools, including ransomware.
• Work data. A stealer on a home PC used for work can open the door to an employer's network.

Kaspersky also notes that installing a surveillance app on another person's phone without consent is illegal in most countries ^[7]. If someone did that to you, it is a crime you can report.

Before you remove spyware: a safety note on stalkerware

If you think a person you know put spyware on your phone, pause before you delete anything. The Coalition Against Stalkerware warns that removing it may alert the abuser and could increase the abuse ^[6]. It recommends a safety plan made with a support service, on a safer device ^[6].

• Removing the app also removes evidence. If you may report it, talk to the police or a support service first ^[6].
• Use a device the person has never had access to when you search for help, because they may see your searches ^[6].
• A new phone is the surest fix, and a factory reset is almost as effective ^[6].
• The person may reinstall it if they can get your phone again, so a new passcode matters as much as the cleanup ^[6].
• If you are in immediate danger, contact local emergency services.

How to remove spyware from Windows

On Windows, spyware is usually a stealer, a keylogger or a remote access trojan. Work through these steps in order. If the spyware is a stealer, assume your passwords are already gone and jump to account recovery on another device first.

1. Disconnect from the internet if you think a remote access tool is active. That cuts the attacker's live connection.
2. Update Windows and Microsoft Defender, then run a full scan in Windows Security. Then run a Microsoft Defender Offline scan, which starts before Windows and catches tools that hide while it runs.
3. Open Settings, then Apps, then Installed apps, and sort by install date. Uninstall monitoring programs, remote desktop tools you did not set up and anything installed around the time trouble began. See how to uninstall a program on Windows.
4. Open Task Manager, then Startup apps, and disable unknown entries. Check Task Scheduler for tasks with random names that run hidden.
5. Clean up the leftovers that keep spyware alive: services, scheduled tasks and Run keys. Our malware leftovers guide goes through each one.
6. Check whether processes with system-like names are genuine, using this process check.
7. If a remote access trojan was involved, follow the RAT removal guide, which covers remote tools, new user accounts and firewall rules.

If scans keep finding something, or you cannot trust the PC any more, reinstalling is the clean answer. Our guide on how to clean or reset Windows compares Reset this PC with a full reinstall. A reset keeps your files, so scan them before you open them again. More Windows help is on our Windows help page.

How to remove spyware from a Mac

Mac spyware is mostly info stealers such as Atomic (AMOS), which arrive with cracked apps and fake installers that ask for your password. Apple's XProtect blocks known malware, moves it to the Trash and alerts you, and its signatures update apart from macOS updates ^[9]. New variants can still slip through for a while.

1. Open Finder, then Applications, and move apps you do not recognize to the Trash.
2. Open System Settings, then General, then Login Items (on newer versions, Login Items and Extensions). Remove unknown items and turn off unknown entries under Allow in the Background.
3. Check the LaunchAgents folders in your user Library and the main Library, and /Library/LaunchDaemons, for .plist files with random or fake Apple-like names.
4. Open System Settings, then Privacy and Security, and look at Screen Recording, Accessibility, Input Monitoring and Full Disk Access. Revoke any app you do not know. A keylogger needs one of these to work.
5. Look for profiles you did not add under Privacy and Security or General, then Device Management.
6. Run a scan with a reputable Mac security tool, then change your passwords from another device.

If you think you may be a target of mercenary spyware, you can turn on Lockdown Mode on a Mac under System Settings, then Privacy and Security ^[3]. Our full walkthrough on how to remove malware from a Mac covers each folder in more detail, and the Mac viruses section lists current threats.

How to remove spyware from Chrome, Edge, Firefox and Safari

Browser spyware is usually an extension that reads every page you open. The second risk is what a stealer already took from the browser: saved passwords and the cookies that keep you signed in. Do these steps in every browser you use.

• Chrome and Edge: open the menu, then Extensions, then Manage extensions, and remove anything you did not install yourself. Give extra attention to ones that can "read and change all your data on all websites".
• Firefox: open the menu, then Add-ons and themes, then Extensions, and remove unknown ones.
• Safari: open Safari, then Settings, then Extensions, and uninstall unknown ones.
• Check that no policy is forcing extensions on you. A "managed by your organization" note on a home PC means a program changed browser policy.
• Reset the browser to defaults. Chrome's option is under Settings, then Reset settings ^[10]. Our browser reset guide covers the others.

Then deal with the stolen data. Sign out of all sessions on your important sites, which kills cookies a stealer took. Delete passwords saved in the browser only after you have moved them to a password manager and changed them. Step by step help is in how to remove a browser extension.

How to remove spyware from Android and iPhone

For a full check of a phone, with each setting to open and what a spy app looks like there, see our guide on how to check your phone for spyware. The short version follows. Read the safety note above first if a person may be behind it.

Android

1. Make sure Play Protect is on. In the Play Store, tap your profile icon, then Play Protect, then Settings, and turn on Scan apps with Play Protect ^[8]. Play Protect checks apps from other sources too and can disable or remove harmful ones ^[8].
2. Open Settings, then Apps, and tap See all apps. Look for names like "System Service", "Sync" or "Device Health" that you do not recognize, and apps with no icon on the home screen.
3. Check Device admin apps. On Android 14 and 15 it is under Settings, then Security and privacy, then More security settings. On Samsung One UI, look under Security and privacy, then Other security settings. Remove admin rights from anything unknown, then uninstall it.
4. Open Settings, then Accessibility, and check Installed apps or Downloaded apps. Spy apps use accessibility to read the screen.
5. Check Special app access, then Notification access and Device and app notifications, for apps that read your alerts.
6. If anything remains, back up your photos and contacts and do a factory reset. Then reinstall only the apps you need ^[6].

More cases are on our Android topic page and in the guide on how to remove malware from Android.

iPhone and iPad

On an iPhone, check who has access to your account and settings, not only which apps are installed. Apple's personal safety checklist covers this, and on iOS 16 or later its Safety Check feature does much of it in one place ^[5].

1. Open Settings, then Privacy and Security, then Safety Check. Use Manage Sharing and Access to review who can see your location and data, or Emergency Reset to stop all sharing at once.
2. Open Settings, tap your name, then look at Devices. Remove any device you do not recognize with Remove from Account ^[5].
3. Change your iPhone passcode and your Apple Account password. Check Face ID and Touch ID for an alternate appearance or a fingerprint you did not add ^[5].
4. Check two-factor authentication for trusted devices or numbers you do not recognize ^[5].
5. Review installed apps, and delete any you do not remember installing ^[5].
6. Open Settings, then General, then VPN and Device Management, and remove any profile you did not install. Apple notes that MDM profiles normally come from employers or schools ^[5].
7. Tap your name, then iCloud, then iCloud Backup. If backup is on and you did not turn it on, someone may be reading your backups ^[6].

If you may be a target of mercenary spyware

Apple sends threat notifications to users it believes were targeted by mercenary spyware. They appear on the Lock Screen and in Settings, by email, and at the top of your page at account.apple.com ^[4]. Apple says these notifications never ask you to click links, open files or install apps, and you can check one is real by signing in to account.apple.com ^[4].

If you get one, Apple suggests turning on Lockdown Mode and getting expert help, such as the free Digital Security Helpline run by Access Now ^[4]. To turn it on, open Settings, then Privacy and Security, then Lockdown Mode, then Turn On Lockdown Mode, and restart ^[3]. It blocks most message attachments, some web features and unknown FaceTime calls, and it stops new configuration profiles from being installed ^[3]. It is meant for the very few people who may be personally targeted ^[3].

More iPhone guides are on our iPhone topic page and the iPhone help page.

After removal: take your accounts back

This is the part people skip, and it matters most. Deleting the spyware does nothing about the passwords and cookies it already sent out. Do the following from a device you trust, such as a phone that was never at risk or a freshly reset computer.

1. Change your main email password first, because every other reset goes through it.
2. Then banking, payment apps, Apple Account or Google Account, and social media.
3. In each account, sign out of all other sessions and remove devices you do not recognize.
4. Turn on two-step verification, preferably with an authenticator app or a passkey ^[2].
5. Check recovery email addresses, phone numbers and forwarding rules that an attacker may have added.
6. Tell your bank if card details may have been taken, and watch statements for a few months.

Our full checklist for securing accounts after malware goes through each account type. To report the crime, see how to report cybercrime and our list of where to report by country.

How to prevent spyware

• Lock your phone with a passcode that others do not know, and set it to lock quickly. The Coalition suggests after about 30 seconds of inactivity ^[6].
• Do not lend your unlocked phone to someone you suspect may want to monitor you ^[6].
• Never download cracked software, keygens or game cheats. That route feeds most info stealers.
• Download apps only from the official store or the developer's site, and do not click software ads ^[2].
• Never paste commands from a web page into Run, PowerShell or Terminal.
• Keep the system, browser and security software updated ^[2][4].
• Use a password manager and unique passwords, so one stolen password does not open everything ^[4].
• Use passkeys or two-step verification on email, banking and your Apple or Google account ^[4].
• Review apps, extensions and device admin rights every few months.

When to use an anti-spyware tool

A scan is the most direct way to find spyware, and the Coalition Against Stalkerware says good antivirus products should detect most stalkerware ^[6]. Start with what you have. Microsoft Defender on Windows, XProtect on macOS ^[9] and Play Protect on Android ^[8] all detect known threats.

A second tool helps when the built-in one finds nothing but the signs continue, when something keeps coming back, or when you want a second opinion after a cracked download. Microsoft Safety Scanner is a free on-demand option on Windows. Spybot Search and Destroy is a long-running anti-spyware program, and SpyHunter and Combo Cleaner are other options we reviewed.

On Windows, Fortect scans for free and repairs the damage malware leaves behind, such as broken system files and registry entries, after the spyware itself is gone. Avoid any product you first met through a pop-up or a fake scan, because that is how rogue anti-spyware sells itself. Our comparison of the best anti-spyware tools sets these side by side.