Detect spy apps and malware. Take your phone back.
GuestSpy finds stalkerware, spy apps and malware on your phone. Every result shows what was found and why.
Works with Android, iPhone, APK files and documents. No account needed.
- Files stay on your device
- 176 spyware families
- Proof for every verdict
Spy apps hide. We look where they live.
Spy apps are sold as normal software, so many antivirus apps let them through. GuestSpy checks what each app can see, who installed it, and whether it hides.
More than a yes-or-no verdict
Every result shows the threat class, a danger code and the evidence behind it.
Take any Android app apart
Drop an APK. We read its certificate, manifest and code, then match it against 176 spyware families.
- Certificate and hash matching
- Hidden services and boot receivers
- Obfuscation and C2 domains
Known stalkerware
system-service-v4.2.apk · com.android.core.monitor
Evidence
Risk profile
Stalkerware found
"System Service" reads your messages and tracks your location.
GS-STK-AND-7843Check every app at once
Paste your app list from one ADB command. Each app is checked for spyware, fakes and odd install sources.
- 640+ known app names
- Fake "system" apps flagged
- Install source for every app
2 suspicious apps of 142
From pm list packages -f -i
Evidence
Risk profile
Read any iPhone profile
Upload a .mobileconfig file. We decode every payload and tell you what it allows.
- Root certificates, proxies, DNS, VPN
- MDM access rights decoded
- Removal locks detected
Dangerous profile
Network_Settings.mobileconfig · unsigned
Evidence
Risk profile
VPN & Device Management
Detect malware before you open a file
PDFs, Office files, EXEs, scripts and archives. We look for macros, hidden payloads and fake extensions.
- 45+ file types by real signature
- Office macros extracted
- Fake extensions caught
No threats found
invoice_march.pdf · 214 KB · PDF 1.7
Evidence
Risk profile
See which apps can read your screen
Most Android spy apps ask for Accessibility or Device admin. With those, they read messages, log keystrokes and block removal. GuestSpy lists every app with these rights and flags the ones that don't belong.
- Accessibility, admin, notifications and VPN in one list
- Fake system apps flagged
- Install source for each app
Catch profiles that take control
On iPhone, spyware usually arrives as a profile or MDM enrolment. It can add a root certificate, route traffic through a proxy or lock settings. GuestSpy reads the profile and explains each part.
- 38 payload types decoded
- Certificates, proxies, DNS and VPN
- 13-step guided check for Apple Account and sharing
Every verdict shows its proof
You get the threat class, a danger code, a confidence level and every piece of evidence. Export it as a PDF for an advocate, a lawyer or the police.
- Danger codes like
GS-STK-AND-7843 - Score breakdown and risk radar
- Free PDF and JSON export
Not sure? See what others found
New spy apps appear under new names every week. If our database doesn't know an app yet, other users might. Check their votes, read their notes, add your own.
- Safe, Suspicious or Malicious votes on every app and file
- No account. One vote per device.
Remove it without putting yourself at risk
Each detection comes with a removal plan for that family. It shows what to turn off first, how to lift admin locks and what to change after.
- Step-by-step for Android and iPhone
- Save the evidence first
- Lock down your accounts after
If you're in an abusive relationship, plan first. In the US, call 1-800-799-7233 or visit stopstalkerware.org.
Typical antivirus vs GuestSpy
| Check | Typical mobile antivirus | GuestSpy |
|---|---|---|
| Known malware signatures | Yes | Yes, plus spy app certificates |
| Spy apps flagged by default | Often as "PUA" only | Always, with family name |
| Accessibility and admin abuse | Sometimes | Every app listed |
| iPhone profiles and MDM | No | 38 payload types |
| Evidence you can show someone | A name and a red icon | Full report, PDF and JSON |
| Safety advice before removal | No | On every detection |
| Price | Free tier, paid upgrades | Free. Everything. |
Recent scans and top threats
Anonymous results from the Web Scanner. We log the verdict, never the file.
Recent scans
Open scannerNo shared scans yet. Results show up here when people share them.
Three steps. About two minutes.
Pick what to check
An APK, your app list, an iPhone profile or any file.
Scan on your device
Hashes, certificates, permissions and code, checked in your browser.
Read the proof, then act
A clear verdict, the reasons, and a removal plan.
Signs someone is watching your phone
Stalkerware is built to stay hidden. Often the first sign is a person who knows things they shouldn’t. The signs below don’t prove anything alone. Several together are a good reason to scan.
Fast battery drain
Recording and uploading your data uses power, even when the phone sits idle.
Warm when idle
The phone feels hot even though you haven’t used it.
Data use spikes
Monitoring apps send your data out over your connection.
Apps you don’t recognise
Watch for dull names like "System Service", "Sync Services" or "WiFi Manager".
Settings you didn’t change
A new device admin, an unknown accessibility service, or "Install unknown apps" switched on.
iPhone profiles you didn’t add
Check Settings > General > VPN & Device Management.
Someone had your unlocked phone
Most stalkerware is installed by hand, by someone you know.
If this sounds familiar, don’t delete anything yet. Read the safety section below first. Then run a scan.
Verdicts you can check
Many scanners say "Threat found" and stop there. GuestSpy tells you what the app is, how sure the scan is, and what the app can do. You can check every claim yourself.
Confidence level
Shows how the verdict was reached, from exact hash match down to behaviour.
Severity score
A number from 0 to 100 based on what the app can do to you.
Danger code
A stable ID like GS-STK-AND-7685 you can look up or quote.
Rule IDs
The exact behaviours found, such as GS-R-014 for a hidden icon.
ATT&CK mapping
93 rules mapped to MITRE ATT&CK, the terms forensic experts use.
Five confidence levels
Some matches are certain. Others are strong hints. GuestSpy always tells you which.
- 1
Exact hash match
The file matches one of about 2,950 confirmed stalkerware samples. - 2
Signing-certificate match
The app is signed by one of 470+ known stalkerware vendors. - 3
Package-name match
The app ID matches one of 640+ names tied to known families. - 4
C2-domain match
The app talks to one of 900+ known stalkerware servers. - 5
Heuristic
No match, but the app behaves like stalkerware.
Danger codes and rule IDs
Codes look like GS-<CLASS>-<PLATFORM>-<NNNN>. The class tells you what was found. STK is stalkerware, WCH is visible watchware, SPY is spyware behaviour, and CFG is a risky setting. GS-STK-AND-7685 is the mSpy family on Android. Look up any code in the threat encyclopedia.
Rule IDs show the evidence behind a verdict. GS-R-014 means the app hides its launcher icon. GS-R-021 means an accessibility service can read your screen. GS-R-030 means it reads SMS, call log and location together.
The Web Scanner: check apps and files in your browser
The Web Scanner checks apps and files without installing anything. It runs fully in your browser. Your files are never uploaded. Open the page, pick a mode, and drop in a file.
App (APK) scan
Drop an Android app to see its signer, permissions, hidden components and servers.
File scan
Spot fake extensions, macros, PDF scripts and hidden executables in 45+ file types.
Installed-apps list check
Paste a package list and match it against 640+ known stalkerware names.
iPhone profile check
Drop a .mobileconfig file and see what it controls, across 38 payload types.
You can choose to share a verdict anonymously. That helps other people who scan the same app.
Stalkerware detection
Detect spy apps with five levels of evidence, from file hash to behaviour rules.
Learn moreAPK & app scanner
Take any Android app apart: permissions, certificate, code and the servers it talks to.
Learn morePermission audit
See which apps can read your screen, messages and location.
Learn moreiPhone security check
Check profiles, MDM, Apple Account devices and sharing.
Learn moreFile scanner
Detect malware in PDFs, Office files, archives, scripts and EXEs.
Learn moreCommunity reports
See how others rated an app or file, and add your vote.
Learn moreAndroid and iPhone: what each check covers
Android
Android lets a scanner inspect every installed app. GuestSpy checks each one’s hash, certificate, package name, servers and behaviour. It also finds apps that hide their launcher icon. Get the app from the download page and tap Scan.
The permission audit then lists every app by risk. It flags device admins, accessibility services and notification listeners.
iPhone
iOS stops apps from seeing other apps. So no App Store app can scan an iPhone the way Android scanners do. GuestSpy checks the routes people really use to monitor iPhones instead.
Profile check
See if a profile adds MDM, a VPN, a root certificate or a proxy.
Apple Account devices
Review devices under Settings > [your name].
Safety Check
Run Settings > Privacy & Security > Safety Check.
iCloud logins
Look for sign-ins you don’t recognise.
Jailbreak signs
Spot changes that let banned apps run.
Forensic backup
Analyse a backup with the free Mobile Verification Toolkit (MVT).
See the iPhone security check for the full steps.
How to scan your Android phone
A full scan takes a few minutes. It changes nothing on the phone and alerts no one.
- 1Install GuestSpy from the download page.
- 2Open the app and tap Scan.
- 3Wait while GuestSpy checks every app, including hidden ones.
- 4Read the verdict: Clean, Low risk, Suspicious, Dangerous or Known stalkerware.
- 5Tap any finding to open the deep report.
- 6Export the report as a PDF or JSON file if you need a record.
The deep report covers the app’s identity, permissions, components, servers and ATT&CK mapping. It also gives a removal plan written for that app.
Community reports
Other users can vote an app or file Safe, Suspicious or Malicious and add a comment. Comments are moderated before they appear. You see them next to the scan results in the deep report.
Votes add context. They never change the automated verdict. Browse reports on the community page.
Before you remove anything
Stalkerware is usually installed by someone close to you. Many apps alert that person when they are removed. If they are abusive, that alert can put you at risk.
Removing stalkerware can alert the person who installed it. Plan first, with someone who understands this risk. In the US, call the National Domestic Violence Hotline at 1-800-799-7233. The Coalition Against Stalkerware at stopstalkerware.org lists support services worldwide. You can save a GuestSpy report now and remove the app later.
Scanning is silent
A scan changes nothing and notifies no one.
Use a safe device
Seek help from a phone or computer the other person can’t access.
Keep the evidence
The PDF report records names, fingerprints, hashes and times.
Secure your accounts
Change passwords and turn on two-factor sign-in, or they may get back in.
Read the safety page before you start. Then follow the guide for Android or iPhone.
Who uses GuestSpy
People leaving a relationship
Check the phone and understand the risk before changing anything.
Support workers and advocates
Triage a client’s phone fast and share a report others can read.
Parents and teenagers
See which monitoring apps are visible watchware and which are hidden stalkerware.
IT and security teams
Get a quick local look at a suspect phone, APK or attachment.
Anyone with a strange file
Check a document or download before you open it.
What GuestSpy can’t do
Scan a phone from a web page
The Web Scanner checks files and lists you give it.
List apps on an iPhone
IOS blocks this, so GuestSpy checks profiles and accounts instead.
Promise a clean phone
Clean means nothing matched. New families still appear.
Remove apps for you
You choose when to remove anything, for your safety.
If a scan is clean but you still feel watched, review your account devices. In high-risk cases, consider a forensic check with MVT.
Frequently asked questions
Is GuestSpy free?
GuestSpy is completely free. That includes the Web Scanner, the Android app and the iPhone app. There’s no account, no scan limit and nothing to buy.
Does the Web Scanner upload my files?
No. Every check runs inside your browser, using a database downloaded to your device. You can watch your browser’s network tab during a scan and see no upload.
Can GuestSpy scan my iPhone?
iOS doesn’t let any app list other apps, so a full app scan isn’t possible. GuestSpy checks configuration profiles and walks you through Apple Account, Safety Check and iCloud checks instead.
What’s the difference between stalkerware and watchware?
Stalkerware hides from you. Watchware is visible monitoring software, like parental-control apps. GuestSpy flags watchware with a WCH code and a lower severity.
Can GuestSpy get it wrong?
It can, mostly at the heuristic level. A screen reader, for example, triggers rule GS-R-021. That’s why each verdict shows its confidence level and every rule that fired.
Is this the old GuestSpy monitoring app?
No. The name was once used by a monitoring app in the TheTruthSpy family. GuestSpy is now protection software, and it flags those old builds as GS-STK-AND-1405. Read more on the about page.
Step-by-step help
Accessibility
Find and remove spyware on Android
Check Accessibility, device admin and hidden apps. Then remove what you find.
VPN & Device Management
Check an iPhone for spyware
Profiles, MDM, Apple Account access and Safety Check.
Before you remove anything
Make a plan, keep evidence and find confidential help.
Check your phone now. It's free.
Scan in your browser in about two minutes, or get the app for Android and iPhone.