Android Stalkerware

Resumen de la amenaza

Stalkerware hides on mobile devices to monitor victims—often installed by someone with physical access. It captures GPS, SMS, photos, and messaging app content.

Comportamiento del ataque

• Background GPS tracking
• Screen capture and keylogging
• Hidden launcher icons

Métodos de infección

• Physical device access
• Social engineering to install "security" apps
• Abuse of enterprise MDM in coercive contexts

Síntomas e indicadores

• Battery drain
• Device warmth when idle
• Unknown admin or accessibility permissions

Mitigación inmediata

• Check device admin and accessibility settings
• Contact support organizations if in abusive situation
• Factory reset from trusted network if needed

Guía de eliminación

• Remove device admin privileges
• Uninstall suspicious apps in safe mode
• Change all account passwords

Métodos de prevención

• Use screen lock and biometrics
• Review installed apps regularly
• Privacy protection permission audits

Indicadores de telemetría

• Accessibility service abuse
• Background location always-on
• Hidden app components