Android spyware.
Most of the surveillance on your phone is not a foreign object someone planted. It is software you installed on purpose, doing things you were never told about.
The word spyware still makes people picture a targeted attack: someone gets access to your phone, installs something hidden, and watches you. That version exists, and it matters, but it is rare and expensive. The everyday version is different and far more common. An app you downloaded from the Play Store bundles third-party code that reads your device identifiers, your rough location, your installed app list, and your usage patterns, and ships that to companies whose names never appear anywhere in the interface.
The line between the two has stopped being a line. Commercial surveillance vendors sell capabilities that overlap heavily with what a free flashlight app collects legally, through consent screens nobody reads. That is why the classic detection advice fails. Checking your battery stats, looking for apps you do not recognize, running an antivirus scan: all three assume spyware is a foreign object with an obvious footprint. Modern tracking SDKs batch their requests, wait for WiFi, and ride along with legitimate traffic. There is nothing to notice.
What works instead is looking at the code. Every Android app ships its logic as compiled bytecode inside the APK, and the tracking SDKs it embeds leave their class names in there. That is a fact about the package, not a guess about behaviour, and it can be checked without root, without a network capture, and without trusting the developer. The posts below take that approach apart: what the SDKs are, how they get into apps, what the permission list adds on top, and how to read the result.
Everything filed under spyware
Commercial Spyware Costs $9 Million Per Deployment. Consumer Apps Get the Same Capabilities for Free.
NSO Group charged governments $9M for Pegasus spyware. Meanwhile, free consumer apps collect the same device data legally through app stores.
The Line Between Spyware and Normal Apps Doesn't Exist Anymore
Most spyware definitions describe features found in mainstream apps. Here's why the old classification system is useless in 2026.
The False Negative Problem: Why Most Spyware Scans Miss What Matters
Most Android spyware detection tools check the wrong things. Here's why 73% of privacy violations hide in plain sight and what actually works.
9 Warning Signs Your Android App Is Spying on You
Is your Android app spying on you? Here are 9 concrete warning signs to look for, from suspicious permissions to unexpected battery drain.
Android Spyware: How to Detect and Remove It
Learn how to find hidden spyware on Android, what antivirus apps miss, how to remove it, and how to protect against stalkerware.
How to detect spyware on Android, for real this time
Forget battery drain tips. Here is what actually works to find spyware and hidden trackers on your Android phone, step by step, no root required.
The spyware detection ritual is broken
Standard spyware detection advice misses the point. The real surveillance on your phone is already installed, sold as features, and completely legal.
Common questions
Can spyware hide on Android without any visible app icon? +
Yes. An app can ship without a launcher icon and still run background services, and system-level packages preinstalled by the manufacturer never appear in your app drawer at all. This is why checking your home screen tells you very little. An installed-package list, which includes everything on the device rather than everything with an icon, is the minimum starting point.
Does battery drain mean I have spyware? +
Almost never. Battery drain is a symptom of badly written software in general, and a poorly coded game will drain more power than any tracker. Tracking SDKs are optimized for stealth: they batch network calls, wait for WiFi, and piggyback on traffic the app was already sending. The heaviest surveillance on a phone is usually invisible in the battery screen.
Is a free antivirus app enough to find it? +
Antivirus tools match against known malware signatures. Most tracking code is not malware in that sense: it is commercial SDKs, shipped deliberately by the developer, often disclosed in a privacy policy nobody read. A scanner looking for malicious files will report a clean device while a dozen analytics and advertising SDKs are running.
What can you actually tell from static analysis? +
Static analysis shows what code is present in the package and which permissions the app declares. It cannot prove that a given SDK is ever called at runtime, or what it transmits when it is. That limit is real and worth stating plainly. What it does give you is evidence rather than marketing copy: the SDK is either in the bytecode or it is not.
Other topics
Check your own apps.
The analysis runs on your device, against the bytecode of the packages you already have installed. No account, no sign-in.
GET IT ON Google Play