Find who's watching.
Take your phone back.

Here is what a lot of security apps tell you when they find something: "Threat found: Trojan.Generic". A red icon, a button that says Remove, and nothing else. No explanation of what the app did, why it was flagged, whether it was the thing you suspected, or whether it was a harmless utility that happened to trip a rule. If you are trying to work out whether someone you live with has been reading your messages, that is close to useless. You need to know what was found, how sure the scanner is, and what you can do about it.

GuestSpy was built around a different idea. The scanner shows its work. Every finding is made of four things you can actually read.

Five evidence levels, in order of certainty

Not all detections are equal, and GuestSpy never pretends they are. Each verdict carries a confidence level that tells you how it was reached. From strongest to weakest:

1. 1

   Exact hash match.

   The app or file has the same SHA-256 fingerprint as a sample that researchers have already confirmed is stalkerware. There is no ambiguity here. GuestSpy’s database currently holds around 2,950 known sample hashes.
2. 2

   Signing-certificate match.

   Every Android app is signed by its developer with a certificate. Stalkerware vendors reuse their certificates across dozens of rebranded builds. If the certificate matches one of the 470+ known stalkerware signers, the app came from that vendor, whatever it calls itself today.
3. 3

   Package-name match.

   The app’s internal identifier, such as com.guest or com.mspy.lite, is on the list of 600+ package names tied to known families. Strong, but a package name can in rare cases be reused by an unrelated developer, so it sits below a certificate match.
4. 4

   C2-domain match.

   The app contains, or talks to, one of 900+ command-and-control domains that stalkerware uses to upload what it collects and receive instructions. This catches rebrands and new builds that have not been fingerprinted yet.
5. 5

   Heuristic.

   No database match, but the app behaves like stalkerware: it hides its icon, holds device administrator rights, uses an accessibility service to read the screen, and reads SMS, call log and location together. This is how GuestSpy catches families nobody has catalogued yet, and it is also where false positives are most likely, which is exactly why the confidence level is shown rather than hidden.

Each verdict also carries a severity from 0 to 100, so a parental-control app that is visible and openly declares what it does lands in a very different place from a hidden app phoning home to a known stalkerware server.

Danger codes

Every finding gets a danger code in the form GS-<CLASS>-<PLATFORM>-<NNNN>. The class tells you what kind of thing was found: STK is stalkerware, WCH is watchware (a visible monitoring or parental app), SPY is spyware behaviour found by heuristics, TRJ is a trojan or dropper, ADW is adware, PUA is potentially unwanted software, CFG is a risky configuration such as a suspicious iOS profile, DOC is a malicious document and CLN is clean. The platform is AND, IOS, WIN, DOC or GEN. The number identifies the family or rule.

So GS-STK-AND-7685 means Android stalkerware from the mSpy family. GS-STK-AND-1405 is the TheTruthSpy family, which includes old builds of an app that used to carry the GuestSpy name. Yes, this product flags its own former namesake. More on that on the about page. The point of a code is that you can look it up in the threat encyclopedia, search for it, quote it to a support worker or a lawyer, and know that it means the same thing every time.

Rule IDs

Below the code sit the evidence rules, each with an ID like GS-R-014. A rule is one specific observation about the app. GS-R-014 is "Hides launcher icon". GS-R-021 is "Accessibility service can read screen content". GS-R-030 is "Reads SMS + call log + location together". When GuestSpy says an app is Suspicious, you can expand the finding and see the exact rules that fired, what each one means, and why it matters. If you disagree with one, you can see which one you disagree with.

ATT&CK mapping

Finally, each rule is mapped to a technique from MITRE ATT&CK for Mobile, the framework that security researchers use to describe what malicious software does. Reading location becomes T1430 Location Tracking. Recording through the microphone is T1429 Audio Capture. Reading texts is T1636.004 SMS Messages. Capturing what you type is T1417.001 Keylogging. Hiding the icon is T1628.001 Suppress Application Icon. Gaining admin rights is T1626.001 Device Administrator Permissions. Taking screenshots is T1513 Screen Capture, and reading your notifications is T1517 Access Notifications. This matters for two reasons. It gives you a vocabulary that matches what a forensic examiner or an IT department would use, and it lets you see at a glance what the app could actually do to you: watch, listen, read, track, or all four.

Not everyone wants to install another app to find out whether an app is safe. Sometimes you have an APK file someone sent you, or a document that arrived from an address you do not recognise, or a list of installed apps you pulled from a phone and want checked. The GuestSpy Web Scanner handles that, and it runs entirely inside your browser.

That last part is worth saying plainly. When you drop a file onto the Web Scanner, the file is not uploaded. The hashing, the unpacking, the manifest parsing and the rule matching all happen in your browser’s own memory, using the indicator database that is downloaded to your device. Nothing you scan leaves your machine. That means you can check a document that contains private information without handing it to a third party, and it means the scanner keeps working even if your connection is poor once the page has loaded.

The Web Scanner has four modes:

• App (APK) scan. Drop an Android app package. GuestSpy reads its manifest, extracts the signing certificate, lists permissions by risk tier, finds hidden-icon tricks, accessibility and device-admin components, embedded domains and IPs, and compares all of it against the database and the heuristic rules. You get a full deep report.
• File scan. Drop a document, archive, script or executable. GuestSpy works out the real file type from its magic bytes rather than trusting the extension, so invoice.pdf.exe is caught as the executable it is. It computes hashes, measures entropy to spot packing or encryption, extracts strings such as URLs and wallet addresses, and looks for Office macros, PDF JavaScript and embedded executables.
• Installed-apps list check. Paste the list of packages from an Android phone, either exported from the GuestSpy app or produced with adb shell pm list packages, and GuestSpy checks every package name against the 600+ known stalkerware identifiers. A fast way to triage a phone that is not yours, such as a client’s or a family member’s.
• iPhone profile check. Drop a .mobileconfig file and GuestSpy analyses what it would do: enrol the device in MDM, install a VPN, add a root certificate, set a global HTTP proxy, change DNS, add Web Clips, apply restrictions or mark itself as impossible to remove. It also tells you whether the profile is signed and by whom.

[ 0.02s] Database ready: 176 families, 2953 hashes, 486 certificates, 1448 domains
[ 0.03s] Analysing "base.apk" locally. Nothing is uploaded.
[ 0.41s] SHA-256 7f3a9c0e2b…  (not in sample database)
[ 0.52s] Package com.guest v2.4.1 (241), label "Sync Services", SDK 19→22
[ 0.53s] 27 permissions, 3 activities, 11 services, 9 receivers, 1 provider
[ 0.61s] Certificate 31A6ECECD97CF39BC4126B8745CD94A7C30BF81C matches family TheTruthSpy
[ 1.14s] classes.dex: 2 310 classes, 14 902 methods, obfuscation 71%

A lot of marketing in this space blurs the line between the two platforms, which leads people to expect things that cannot happen. GuestSpy would rather you understand the real picture.

Android

Android lets one app inspect the others. An installed scanner can list every package on the phone, read each one’s manifest, check its signing certificate, see which permissions it holds, which services and receivers it registers, whether it has hidden its launcher icon, whether it is a device administrator, whether it runs an accessibility service or notification listener, and whether it starts itself at boot. That is a lot of ground, and it is exactly the ground stalkerware lives on. On Android, GuestSpy can do a genuinely thorough job: full database matching across hashes, certificates, package names and domains, plus the heuristic rules, plus a permission audit of everything else on the phone.

Android is also where most stalkerware lives, for the simple reason that it is where sideloading is possible. Someone with your unlocked phone can switch on "Install unknown apps" for a browser, download an APK from a vendor’s website, install it, grant it everything it asks for, hide its icon and hand the phone back in a few minutes. The vendors write step-by-step guides for exactly this.

iPhone

iOS is a different world. Apps on iOS cannot list other installed apps, cannot read other apps’ data and cannot inspect their permissions. That is a security feature and a good one, but it means no app on the App Store, including GuestSpy, can scan your iPhone the way an Android scanner can. Anyone who tells you otherwise is describing something that does not exist.

What is possible on iPhone is different and often more about configuration than about apps. The common surveillance routes are: a configuration profile that routes your traffic through someone else’s server or enrols your phone in a mobile device management system; a VPN installed for "security" that actually logs; a root certificate that lets someone read encrypted traffic; a second device signed into your Apple Account that receives your messages and backups; an unknown login to your iCloud; and, less often now, a jailbroken phone running software that iOS would otherwise forbid.

So GuestSpy’s iPhone security check does two things. It analyses configuration profiles, either exported .mobileconfig files or the ones you find under Settings > General > VPN & Device Management, and explains exactly what each one grants. And it walks you through guided checks that only you can do from the phone itself: reviewing devices under Settings > [your name], running Safety Check under Settings > Privacy & Security > Safety Check, looking for unknown iCloud logins, checking for jailbreak signs, and, for people who need a forensic answer, taking a backup and analysing it with the open-source Mobile Verification Toolkit (MVT). Honest, step-by-step, and no pretending.

Databases are strong on what is already known. People are strong on what is new. GuestSpy’s community reports let anyone who has run a scan vote on an app package or a file hash as Safe, Suspicious or Malicious, and leave a comment explaining why. Someone might note that a "WiFi Manager" app appeared on their phone after a partner borrowed it. Someone else might point out that a flagged parental-control app was one they installed themselves and that it shows an icon and a notification.

Reports are moderated before they are published, and GuestSpy does not seed them. If a package has no reports yet, the page says so. When reports exist, they appear in the deep report under Community verdicts next to the automated evidence, so you can weigh the two together. The automated verdict never changes because of votes; the votes are context, not a rule.

This is the part of the page we would ask you to read even if you skip everything else.

Stalkerware is usually installed by someone close to you. If that person is abusive or controlling, the moment you remove the software may be the moment they find out you know. Many of these apps send an alert to the installer when they are uninstalled, when the device admin is revoked, or simply when the stream of data stops. That can escalate a dangerous situation quickly.

A few practical points that go with that:

The safety page goes into all of this in more depth, and both removal guides, for Android and iPhone, repeat the warning at the point where it matters.

If you have never used a scanner that explains itself, here is how a GuestSpy scan on Android actually runs.

First, GuestSpy enumerates every installed package, including ones with no launcher icon, which is where hidden apps live. For each package, it reads the manifest and the signing certificate, and computes the hash of the installed APK. Each of those is compared against the database: hashes against the known-sample list, certificates against the known-signer list, package names against the family list. Embedded domains and any observable network indicators are compared against the C2 list. Then the heuristic rules run, looking at the combination of permissions and components rather than any single one.

The result is a verdict for each app: Clean, Low risk, Suspicious, Dangerous or Known stalkerware. The phone as a whole gets the worst verdict found. Anything above Clean gets a danger code, a confidence level, a severity score and the list of rules that fired, each mapped to its ATT&CK technique.

Tap any finding and you get the deep report: Overview, Identity (package, version, SDK levels, certificate SHA-1 and SHA-256 and issuer), Permissions by risk tier, Components, Network indicators, Code details such as dex count, native libraries and packers, the ATT&CK mapping, a Removal plan written for that specific app, and Community verdicts. The whole thing exports as a PDF.

[00.84s] com.android.core.monitor → cert 0E0BE37D… MATCH Hoverwatch
[00.91s] com.whatsapp → clean
[00.93s] com.systemservice → pkg MATCH TheTruthSpy
[01.02s] com.wondershare.famisafe → watchware
[01.05s] org.telegram.messenger → clean