Is someone tracking you? Signs that you may have been targeted by stalkerware

Updated on: 15 November 2023

Jurgita Lapienytė
Chief Editor

Are your emails disappearing? Does it feel like someone knows where you are at all times? Does someone recite you one of your conversations that you thought was secret? These are all indicators that stalkerware is potentially being used against you. If you are in an abusive relationship, don’t rush to uninstall it.

The lockdowns have yet another dark side - experts have registered an uptick in intimate partner violence cases. Quite often, the victims of domestic violence have reported that they were being tracked and monitored.

The use of stalkerware against someone can cause serious psychological damage, including fear, anger, hypervigilance, and PTSD. Experts do not necessarily recommend uninstalling spyware, as every case is individual.

The rise of abusive stalkerware

National Network to End Domestic Violence (NNEDV) in the US saw a rise in domestic violence cases during the pandemic. Rachel Gibson from NNEDV told CyberNews that intimate partner violence can rise in many cases, for example during a pandemic, natural disaster, when large conventions or sports games come to town, and more.

“It is not to say that the lockdown caused the abuse. It, however, can be said that the pandemic, the lockdown can add to the stress, isolation, and create a situation where survivors are further unsafe due to this situation,” she told CyberNews.

People are reporting quite often that they are being tracked and monitored. According to the Coalition Against Stalkerware, the use of malicious applications as tools of domestic abuse against women has skyrocketed during the pandemic.

“Domestic violence is rooted in power and control, and stalkerware allows for someone to use their power to spy and monitor,” Gibson said.

Some products are solely made to monitor and harass people, she added. There are numerous products marketed towards cheating spouses and businesses to monitor employees.

“Find anyone’s location!” an ad for one of those stalkerware apps reads. It shows a desperate woman texting her spouse, who is in bed with another woman, yet lies via text that he is in the meeting.

Sometimes monitoring activities may not be stalkerware, as many abusers have access to their victims’ personally identifiable information, and therefore don’t really need to use any malware to stalk them.

How can you tell someone’s stalking you?

“As these apps are disguised quite cleverly, users would need to pay extra attention to how the phone behaviors are before being able to suspect that there's stalkerware installed,” Calvin Gan, a researcher in F-Secure Tactical Defense Unit, told CyberNews.

Stalkerware works just like a normal app but requires certain functionality of the phone to collect and send information.

What gives a stalkerware app away? If your mobile data usage increases, the battery is drained quicker than usual, settings like location or Bluetooth are turned on automatically, it might mean that there's spyware installed on your device. Gan noted that this behavior is common for Apple iPhones as these functions will turn on automatically after a day of you turning it off.

“There are also times when you may spot some unusual notification that appears briefly and disappears. For Android, the option to install apps from Unknown Sources in Settings may have been enabled even when you have not done so,” he said.

Other tell-tale signs could be spotted from your account activity, especially email clients. You have to pay close attention to account activity logs - maybe there were some emails sent without your knowledge, or there’s login activity on social media or bank apps that you did not commit.

“On a good note, Apple is quite restrictive in system access for apps. The best way to prevent stalkerware from being installed is by not jailbreaking/rooting the phone and only using apps from the official App Store,” he said.

There are a few possible ways a stalkerware can be installed. According to Gan, the easiest is probably for the abuser to coax the victim, knowingly or unknowingly, into handing over their phone. Social engineering methods, such as phishing emails, could also be used to trick victims into installing stalkerware.

“Thirdly, the victim could unknowingly install a stalkerware app that came bundled with other software when visiting dubious sites or downloading apps from third party app stores. When installing an app, it is always a good measure to check the permission list before proceeding. If there are permissions that you are uncomfortable with, choose an alternative app or understand the risks involved if you proceed with the installation,” he explained.

To install stalkerware, an abuser needs administrator privileges to access certain permissions.

“This is mostly for Android devices as the iOS ecosystem is quite restrictive. As long as the device is not jailbroken and apps are only installed from the official App Store, the user would have a lesser chance of having stalkerware installed,” Gan said.

According to the Coalition Against Stalkerware, these signs might indicate there’s stalkerware on your device:

Mobile phone, device or laptop goes missing and reappears.Strange behavior from the device operating system or applications.
Unfamiliar app or process is on your device.
Lending your device for an extended period of time to someone and noticing changes in settings or unknown apps you do not recognize.
‘Unknown sources’ setting ‘Enabled’ on an Android device.
Unexpected battery drain.
Presence of an app called Cydia (iOS devices).
Active sessions on devices you did not authorize.
Using easy passwords that someone close to you can guess.
Webcam permissions are on for applications you did not give permission to.

Is it safe to uninstall stalkerware?

“What is safe for one person may not be safe for another. Survivors are the experts in their lives and can often gauge what may cause an abusive person to escalate. A person experiencing abuse may not only be just experiencing technology misuse, but they could also be experiencing physical, emotional, religious, and many other tactics of abuse,” Gibson said.

Just because you got rid of the technology might not necessarily mean the abuse will stop.

“It is not the technology that is causing harm, it is the person behind the technology, and the accountability should be on them. Technology misuse is old behaviors like stalking, isolation, harassment, and intimidation that we have seen for years, manifesting through the use of new tools like stalkerware, location monitoring, and online harassment,” she said.

Uninstalling the stalkerware could alert the abusive person that the survivor is taking steps to get help, and it could escalate the violence, and the survivor may lose evidence if they decide later that they want to seek legal recourse.

Gan’s first action would be to report the incident to the relevant authority body to protect the information from being stolen and used for malicious purposes. Uninstalling the offending app might seem like the natural next step, but it’s not recommended.

“Do note that the stalker/abuser would have already noticed that information is no longer flowing from your device upon uninstalling. They may then find a way to reinstall the app on your phone through different means. The best way is probably to perform a hard reset and reformat the device. Some stalkerware may survive even a reset, so the next best option would be to change to a new phone,” Gan explained.

After the above, the next steps would be changing passwords, installing security solutions, and downloading apps from the official app stores only.

Reporting abuse may not be the safest option for every person, and for victims to seek recourse does not necessarily mean going through the legal system.

“Like any tool that is being used to harass, stalk and invoke fear, stalkerware could deter someone from reporting the abuse they have experienced. Survivors should be given as many resources and detailed information about what reporting the abuse means for them and their safety,” Gibson said.

Often victims are hesitant to report abuse for many reasons. Quite commonly, people simply do not trust justice systems.

“Will the police believe them? Especially if the technology is involved and they report things that may sound far fetched. Survivors may have told someone before that they were experiencing abuse, and it could have been pushed off, or they could have been judged. Professionals, friends, family, and the community must start by believing survivors if they want survivors to begin to feel comfortable in reporting the abuse they have experienced,” she said.

Often victims just want the abuse to stop without their intimate partners getting in trouble.

“Many survivors share families and lives with their abuser reporting them could mean that their livelihood could be in jeopardy,” she explained.

The use of stalkelware is another tool used to invoke fear, intimidation, and isolation, and it can cause severe psychological trauma.

"PTSD, hypervigilance, fear, anger and more can all be effects of abuse experienced. When stalkerware is involved, this could lead to survivors feeling mistrust of technology, fearful of going on their devices, and feeling like they are always being watched. When used with other forms of abuse, it can escalate the trauma responses someone has to their situation, family, and others,” Gibson explained.

Bystanders' intervention is an important part of victims seeking help, she added.

“When a bystander believes a survivor and provides support, this could be the time that they decide to leave and seek help. However, again if someone is being tracked, monitored, or stalked and they flee to a friend or family member’s home, this could indicate to the abuser where they are. Working with a domestic violence advocate can help survivors determine a safety plan and what to consider before they flee. This means thinking about what technology they will bring, making sure location sharing is turned off, and other helpful tips and strategies to help minimize risk,” Gibson explained.