Hoverwatch

Hoverwatch is a stalkerware family: software built to monitor a phone without the owner knowing. It typically hides its icon, runs at boot and sends messages, call logs, location and media to a web dashboard that the person who installed it logs into. It is also sold or distributed as SpyBubble, Refog.

How GuestSpy detects it

The Web Scanner and the GuestSpy apps match this family on up to five levels of evidence. Any one of them is enough for a verdict; the stronger the level, the higher the confidence shown in the report.

• Exact file hash: 41 known samples (SHA-256).
• Signing certificate: 10 developer certificate fingerprints. A rebuilt or renamed APK signed with the same key is still caught.
• Package name: 32 known package identifiers.
• Network indicators: 36 domains and 5 IP addresses used for its dashboard, downloads or command-and-control traffic.
• Behaviour rules: the heuristic rules (GS-R-0xx) that catch hidden icons, accessibility abuse, device-admin persistence and surveillance permission combinations, which also catch new builds that have not been seen before.

If GuestSpy reports this on your phone

1. Preserve evidence if you may need it: screenshots of the app, its permissions, the report from GuestSpy, dates.
2. Remove device-admin rights: Settings › Security › Device admin apps (names vary by manufacturer). Deactivate the app so Android lets you uninstall it.
3. Revoke accessibility and notification access: Settings › Accessibility › Downloaded apps, and Settings › Notifications › Device & app notifications / Notification access.
4. Force stop and uninstall from Settings › Apps. If "Uninstall" is greyed out, use Safe mode or adb shell pm uninstall -k --user 0 <package>.
5. Check accounts and sharing: unknown Google accounts, Find My Device sharing, Family Link, work profiles.
6. Re-scan with GuestSpy, then change your passwords from a device you trust and turn on two-factor authentication with an authenticator app.

The full walkthrough is in the Android removal guide and the iPhone guide.

Indicators are drawn from the open-source stalkerware indicator database maintained by Echap (CC-BY 4.0) and from GuestSpy research. Indicator lists are never perfect; if you believe an entry is wrong, use the community report form on the scanner page.