Spyzie Stalkerware: How To Detect And Remove It (2026)

Spyzie is a phone surveillance app, usually called stalkerware, that hides on a device and sends its messages, photos, call logs and location to someone else. In February 2025 a security researcher showed that a bug in Spyzie let anyone read that stolen data, and TechCrunch reported that the app had compromised more than half a million Android phones and thousands of iPhones and iPads.[1] You can check for it today: on Android with a hidden app code and the app list, on iPhone by securing your Apple Account and looking at your iCloud backup settings.

This guide is for two groups. The first is anyone who suspects that a partner, ex-partner or relative is watching their phone. The second is anyone who found their email address in a Spyzie leak. Read the safety section before you remove anything, because taking the app off can alert the person who installed it.[5][6]

Spyzie timeline: from first accounts to the leak

The dates below come from the TechCrunch reports and the Have I Been Pwned listing. They describe the leak, not when the app was first sold, which we could not establish.

• February 2020. The earliest Apple device owner in the leaked Spyzie records dates from around this time.[1]
• July 2024. The most recent Apple device owner in the same records.[1]
• February 20, 2025. TechCrunch reports a bug in the sister apps Cocospy and Spyic that exposes phone data and customer emails.[2]
• February 27, 2025. TechCrunch reports that Spyzie has the same bug. The researcher collected 518,643 customer email addresses and passed them to Have I Been Pwned.[1][12]
• February 28, 2025. Malwarebytes confirms the three apps share the problem and says it detects them on Android.[4] This is also the date of our first, short version of this article.
• February 9, 2026. TechCrunch updates its running tally to 27 stalkerware companies hacked or leaked since 2017, up from 24 when Spyzie was added.[1][3]

What Spyzie is and how it works

Spyzie belongs to a family of apps that TechCrunch says are typically sold as parental control or employee monitoring tools but work as covert spying tools.[2] The Coalition Against Stalkerware defines stalkerware as software that runs hidden in the background and lets someone spy on another person's private life through their device, without that person knowing or agreeing.[6] Phone monitoring apps that do not hide are a different matter, and we come back to them near the end.

TechCrunch describes Spyzie as a little-known operation with almost no online presence, banned by Google from running search ads, which still gathered thousands of paying customers.[1] Together with Cocospy and Spyic, which share the same source code, the three apps are used by more than 3 million customers, according to TechCrunch.[1] For the Android side, the apps are designed to stay off the home screen and keep uploading the contents of the device to the operator's servers, where the person who planted the app can read them.[1]

The FTC lists what this kind of software can do: track your location, switch on the microphone to record conversations, read texts and emails, and show your photos, videos and online activity.[5] The agency adds that some stalkerware makers even publish instructions for turning off the notifications that would warn a phone owner, and that some apps hide under bland names such as "System Service".[5] TechCrunch saw the same disguise when it ran the sister apps Cocospy and Spyic in a test environment.[2]

How Spyzie reaches Android and iPhone

The two platforms are attacked in different ways, and that changes how you check and clean them.

On Android, the app has to be installed on the phone itself. TechCrunch's copy of the leaked data shows that most affected Spyzie victims use Android, and that those phones had to be physically accessed to plant the app, usually by someone who knew the passcode.[1] That is one reason the apps turn up in abusive relationships, where partners often know each other's passcodes.[1] Kaspersky makes the same point: the person only needs physical access to the device and an internet connection.[7]

On iPhone and iPad, Apple's rules about which apps can run are stricter, so stalkerware usually reads the data a person keeps in iCloud by logging in with the victim's Apple Account credentials, rather than running on the device.[1] The leaked Spyzie records show at least 4,900 iPhones and iPads compromised this way.[1] Kaspersky notes that a closed system like iOS forces a would-be stalker to jailbreak the device first if they want to install software on it.[7] The Coalition Against Stalkerware adds that some iPhone stalkerware reads iCloud backups.[6]

What the Spyzie leak exposed

The bug has two sides. It exposes the data that Spyzie copies off a victim's phone, which TechCrunch lists as messages, photos and location data, and it exposes the email address of every customer who signed up to spy on someone.[1] The researcher exploited it to collect 518,643 unique customer email addresses and handed them to TechCrunch and to Troy Hunt, who runs Have I Been Pwned.[1] The listing there shows 518.6 thousand accounts for Spyzie, added on February 27, 2025.[12]

Malwarebytes, repeating the TechCrunch findings, puts the sister numbers next to it: 1.81 million Cocospy customer emails and 880,167 for Spyic.[4] TechCrunch's earlier report on the sister apps quotes Have I Been Pwned as loading 2.65 million unique addresses for the Cocospy and Spyic pair after removing duplicates.[2] Entries of this kind are flagged as sensitive on Have I Been Pwned, which means that only the owner of an address can look it up.[2]

The old version of this article said the leak exposed "over 500,000 victims and customers" and the emails of 518,000 paid subscribers. Both numbers need a correction. The 500,000 figure refers to Android devices, and the 518,643 figure counts customer email addresses, whether or not they paid.[1] It is also worth keeping in mind what the leak did not give anyone: TechCrunch could not identify individual victims from the scraped data.[1]

Why this matters even if you never used the app

Because the bug let anyone read uploaded data, the exposure was not limited to the person who planted the app. Anyone who knew about the flaw could in principle read the same dashboard data.[1] The operators did not answer TechCrunch's request for comment, and the bug had not been fixed when the story ran.[1] We found no later report saying it was fixed, and we cannot say whether it is still open.

The customers are exposed too. InformationWeek, writing about the 2024 mSpy breach, notes that people who use monitoring apps risk brand damage and legal trouble if their use becomes public. It quotes a security engineer who says these apps are often used to watch people without their consent, which is illegal.[11] Malwarebytes makes the same warning to would-be buyers: the risk of being exposed yourself is a recurring deterrent, and it is illegal in almost every country unless done with government consent or to monitor your children, where rules can still be murky.[4]

Is my phone affected? Signs to check

There is no sign that proves stalkerware is present, and some stalkerware runs without any visible side effect.[6] The Coalition Against Stalkerware also warns that if someone is secretly tracking you, stalkerware may not be involved at all.[6] Use the signs below as prompts to check, not as a verdict.

• Phone behavior. The FTC suggests asking whether the battery drains faster than usual, data use has risen, the phone overheats, or it turns itself off and on.[5]
• Extra heat and sluggishness. Malwarebytes lists a warm device when idle, longer shutdown times, slower responses and odd noises during calls.[4]
• What another person knows. The FTC points to someone who knows your exact location without being told, details of private conversations, who you text, or sites you visit.[5]
• Unexplained Screen Time or notifications. The Coalition lists spikes in data use, unexplained rises in weekly Screen Time reports and strange notifications as possible signs.[6]
• Your email in a leak. If your address is in a Spyzie listing, that points to a customer, not a victim, so it does not show your own phone was watched.[1][12]

Keep a short log of what you notice, with dates. The Coalition says a log helps detect patterns and gives a history if you report to law enforcement or a survivor assistance program.[6]

Think about safety before you remove anything

This step comes first because the person who planted the app may see that you found it. TechCrunch warns that switching off spyware can alert the person who planted it and advises having a safety plan.[1] The FTC says an abuser who uses stalkerware may escalate if they think you are cutting off their access, and suggests speaking to a domestic violence advocate first.[5]

In the United States the National Domestic Violence Hotline answers at 1-800-799-7233, by chat or by texting START to 88788.[5] If you contact an advocate or the police, do not do it from the phone that may carry stalkerware. The FTC suggests borrowing a device from a friend or buying a pay as you go phone.[5] Kaspersky gives the same guidance and adds that its own privacy alert now warns users that removal will tell the person who installed the software.[7] If you are in immediate danger, contact local emergency services.

Removal can also destroy evidence. The Coalition notes that deleting stalkerware deletes evidence connected to it, and that someone may reinstall it later.[6] The FTC advises documenting abuse before you replace or reset the phone.[5]

How to detect Spyzie on Android

Two practical checks are available, and both come from TechCrunch's testing of Spyzie and its sister apps.

The 001 code. TechCrunch says you can usually type 001, surrounded by asterisks as it prints the code, into the Android phone app's keypad and press call. If Spyzie is installed it should appear on screen.[1] The outlet explains that this is a backdoor built into the app so that the person who planted it can get back in, and that it works the same way for the sister apps Cocospy and Spyic.[1][2] We have not tested it ourselves. A blank result does not prove the phone is clean, because the code may differ in a changed version of the app.

The app list. The sister apps appear under the generic name "System Service", and TechCrunch says you can check installed apps through the apps menu in Android Settings even when an app is hidden from the home screen.[2] Look for apps you do not recognize, apps you did not install, and any app that asks for access to messages, location, accessibility or notifications.

A security scan. Malwarebytes says it detects Spyzie, Cocospy and Spyic as Android/Monitor.CocoSpy.[4] Scanner quality varies, though. In a joint test by the Electronic Frontier Foundation and AV-Comparatives, only one product, from Malwarebytes, detected all of the 17 stalkerware apps tested, and several others missed one of the 17.[9] The test also found that installing the apps often meant first switching off Google Play Protect, which helps explain why one product blocked only 53 percent of installations.[9]

Root and unknown sources. The FTC says some stalkerware needs a phone that has been rooted or jailbroken, and points to a guide from the National Network to End Domestic Violence for checking this.[5] The Clinic to End Tech Abuse has a guide, listed on the Coalition's page, for finding hidden apps and apps installed outside the official store.[6] Stalkerware is typically installed outside the store.[6]

How to detect Spyzie on iPhone

Because Spyzie reads your iCloud data with your Apple Account password, the useful checks are about the account, not the phone. Apple's own page on a compromised account lists signs such as sign in alerts you do not recognize, two factor codes you did not request, trusted devices you did not add, and a password that no longer works.[8]

Check the iCloud Backup setting as well. The Coalition says some iPhone stalkerware works from iCloud backups, and that if backup is switched on and you did not do it, someone may have done it for bad reasons. To look, open Settings, tap your name, scroll down and tap your device, and see whether iCloud Backup is enabled.[6]

Apple's guide also tells you to open Settings, tap your name and confirm the Apple Account email address shown on each device, and to check services such as FaceTime, Messages and Mail.[8] Anyone who can sign in to your Apple Account means the account is not secure, in Apple's words.[8]

Kaspersky adds that a stalker needs to jailbreak an iPhone before installing software on it, so a jailbroken phone you did not modify yourself is a warning sign.[7]

How to remove Spyzie and similar stalkerware: six steps

1. Think about safety first. Follow the safety section above. Reach an advocate or support organization from a device that is not monitored, and decide whether removal is safe in your situation.[5][6]

2. Keep the evidence. Write down the names of suspicious apps, the dates you noticed them and any odd messages, and take screenshots if you can do it safely. The FTC says to document abuse before you replace or reset the phone.[5]

3. Check the phone and the account. Use the Android and iPhone checks above. If you find the app, you can remove it from the app settings, or let a security app remove it. Kaspersky lists scanning, uninstalling apps you did not install, updating the operating system and a factory reset as the main removal routes.[7]

4. Lock your accounts. Change the password of your Apple Account or Google account from a device you trust. Apple tells you to change the password, remove devices you do not recognize at account.apple.com and make sure you control the email addresses and phone numbers tied to the account.[8] Turn on two factor authentication, and see our guide to two step verification. TechCrunch calls two factor authentication a key protection against account hacks and a primary way stalkerware targets data.[1]

5. Remove the app or reset the phone. The Coalition says the best way to get rid of stalkerware is to buy a new phone, and that a factory reset is almost as effective.[6] The FTC agrees that a new phone with an account the abuser cannot reach is the safest route, and that a full factory reset may remove stalkerware if you must keep the phone.[5] Back up only what you need, such as contacts and photos, first.[6]

6. Do not restore apps from a backup. Whether you reset the phone or get a new one, the FTC says not to reinstall apps from a backup of the old phone, because that could reinstall the stalkerware. Download them again from the app store.[5] Then change your lock screen code to at least six digits, and set the phone to lock quickly. The Coalition suggests locking after about 30 seconds of inactivity.[5][6]

Old advice from our first version of this article, that a person should reset the passcode after uninstalling and update the phone, still holds, and so does the advice to back up data before a factory reset. What changed is the order: safety and evidence now come before removal, and the iPhone steps now center on the Apple Account.

How to protect your phone from stalkerware

• Keep the phone in your own hands. The FTC says not to give someone you worry about unsupervised access to it.[5]
• Use a passcode that is not easy to guess, at least six digits according to the FTC, and change it if you think someone knows it.[5]
• Update the operating system and your apps, because updates carry security patches.[5]
• Use strong, separate passwords for email, social media and your Apple or Google account, and switch on two factor authentication.[5][6]
• Keep Google Play Protect on. TechCrunch calls it a helpful safeguard against malicious Android apps, including stalkerware.[2]
• Check the devices signed in to your Apple Account from time to time and remove any you do not recognize.[8]

Scams and risks to expect after a stalkerware leak

This section is our analysis of the risks, based on what the data allows and on general guidance from the NCSC. We have no report of a campaign aimed specifically at Spyzie customers.

The NCSC explains that criminals exploit high profile breaches, even when your own details were not taken, and may pose as an organization that suffered one.[10] A Spyzie leak is a special case, because the people in it signed up to do something illegal or at least unethical, and they may be reluctant to ask for help. That makes the data attractive for pressure and extortion. We do not know of any cases, and you should treat that as a risk, not a finding.

• A message that says your email appears in a spy app leak and demands payment. Do not pay, and see our guide to reporting cybercrime.
• A text or email that claims to come from a phone security company and asks you to log in or download a cleaner. The NCSC warns about messages that mention password resets, scanning devices or urgent deadlines.[10]
• A call from someone who knows a few details about your phone and asks for access. Hang up and contact the company through its official website.[10]
• A fake "stalkerware remover" app. Use the tools named by the Coalition and by recognized security vendors, and download them only from the official store.[6]

Our check page and the data breaches hub list other incidents and explain how to look for your own email in public leaks. The NCSC also mentions Have I Been Pwned as a way to check whether your details appeared in public breaches.[10]

How Spyzie compares with other stalkerware incidents

TechCrunch's tally counted 27 stalkerware companies known to have been hacked or to have leaked customer and victim data online since 2017, and at least four were hit more than once.[3] Eight of them have shut down.[3] The security researcher Eva Galperin of the Electronic Frontier Foundation calls the industry a soft target, and says that when a stalkerware company dies, another often comes up like mushrooms after the rain.[3]

The wider trend is not clear. Malwarebytes data from 2023 suggested stalkerware use was declining, but Galperin says security firms may now be worse at detecting it, or stalkers may be moving to physical trackers.[3] The EFF and AV-Comparatives test counted slightly fewer stalkerware apps than in 2020 and 2021, and offers the same two possible explanations.[9] For a legal case that did end an operation, see our article on the FTC ban on SpyFone.

Parental monitoring is not the same thing

Parents who want to watch a child's phone often meet the same apps in search results. TechCrunch notes that using such apps on your own children is legal in the United States, but that it is still intrusive, and that even then a leak puts the child's data at risk.[1][3] Eva Galperin's view, quoted by TechCrunch, is that parents should not spy on their children without telling them and without their consent.[3]

If you do tell your child and agree on it, TechCrunch suggests the parental tools built into Apple and Android devices, which work in the open and are safer than apps with a record of leaks.[3] Our reading of the sources is simple: an app that hides itself from the person it watches is a bad choice whatever the purpose, because the hiding is also what makes it dangerous when it leaks.

What is still unknown

• Who runs Spyzie. TechCrunch's report names no operator, and the operators did not answer its questions.[1]
• Whether the bug was ever fixed. It was open when TechCrunch published, and we found no later confirmation.[1]
• How many victims there are today. The leaked records show device owners up to mid 2024 for Apple devices, and the data does not allow victims to be named.[1]
• How many phones still run Spyzie. Nobody has published a current count.
• Whether the leaked data was copied beyond the researcher. The sources do not say.
• When Spyzie first went on sale. The sources we read do not give a launch date.

We will update this article when TechCrunch, the Coalition Against Stalkerware or another primary source publishes more. It was first published on February 28, 2025 and rewritten on October 6, 2026.