Stalkerware is software installed on your phone, usually by someone you know, to watch what you do without your knowledge. It reads your messages, records your calls, tracks where you go, listens through the microphone, takes screenshots and sends all of it to a web panel that the other person logs into from anywhere. It is sold openly, often as a "parental control" or "employee monitoring" product with a wink, and it is designed from the first line of code to not be noticed.
GuestSpy’s stalkerware detection is built to notice it anyway, and then to prove it. This page explains how stalkerware hides, how each of GuestSpy’s five evidence levels works, with examples from real families, what the danger codes and ATT&CK references mean, how false positives are handled, and what to do once something is found.
If you think someone close to you may be monitoring your phone and that person could be a danger to you, please read the section on what to do after a detection before removing anything. Removing stalkerware can alert the person who installed it. The Coalition Against Stalkerware at stopstalkerware.org and, in the US, the National Domestic Violence Hotline at 1-800-799-7233 can help you plan safely.
What stalkerware is, and what it is not
The word covers a specific thing: an app that monitors a person covertly, installed by someone with access to the device. It differs from ordinary malware in two ways. First, the attacker is not a stranger on the internet but someone with your passcode and a few minutes alone with your phone. Second, the software is commercial. There are companies with websites, pricing pages and customer support whose product is reading another person’s texts.
The families in GuestSpy’s database make this concrete. TheTruthSpy is a vendor that has shipped the same core app under more than a dozen names, including Copy9, iSpyoo, MxSpy, SpyZee, FoneTracker and, in the past, GuestSpy itself. Yes, this product’s name was once attached to a monitoring app in that family. GuestSpy has been rebuilt as protection software, and its scanner flags old GuestSpy monitoring builds, package com.guest, under danger code GS-STK-AND-1405 like any other member of the family. The about page tells that story in full; it is mentioned here because a detection page that skipped it would be dishonest.
mSpy is one of the most widely sold. It has shipped under package names such as com.mspy.lite, android.helper.system, android.sys.process and core.framework, names that are chosen to look like part of the operating system. FlexiSpy is at the expensive end and has historically offered call recording and ambient listening; packages have included com.vvt.android.syncmanager and com.android.phone.dialer. Hoverwatch hides under com.android.core.monitor and variations, again borrowing the com.android prefix to look official. Cerberus started as an anti-theft tool and is still sold as one, but has been widely used for covert monitoring, under packages such as com.lsdroid.cerberus and com.lsdroid.cerberus.persona.
Then there is a second class. Watchware is GuestSpy’s term for monitoring software that does not hide. Parental-control apps such as FamiSafe (com.wondershare.famisafe) show an icon, often show a persistent notification, and are marketed to parents and employers rather than to suspicious partners. Twenty-seven of the 176 families in the database are watchware. GuestSpy reports them with a WCH danger code and a lower severity, because there are entirely legitimate reasons for them to be on a phone. But it does report them, because the question of whether you consented is one only you can answer, and some watchware grants the watcher nearly everything stalkerware does.
How stalkerware hides
A scanner that does not understand concealment will miss the thing it is looking for. These are the techniques GuestSpy’s rules are written against.
Icon hiding.
The app installs with a launcher icon, then disables its own launcher activity, or never declares one at all. It no longer appears in the app drawer. It still appears under Settings > Apps if you know to look, but under a name chosen to be ignored. This is rule GS-R-014, "Hides launcher icon", and maps to ATT&CK T1628.001 Suppress Application Icon.
System-looking names.
"System Service". "Sync Services". "WiFi Manager". "Update Service". "Device Health". "Android System". The app’s label and icon are picked so that a person scrolling through Settings > Apps slides past them. Package names do the same job: com.systemservice, android.sys.process, com.android.core.monitor. GuestSpy flags packages that imitate system namespaces without being signed by the platform.
Device administrator. Android’s device admin API was meant for corporate management and anti-theft. Stalkerware uses it because an app with admin rights cannot be uninstalled until admin is revoked, and because some admin policies let it wipe or lock the device as a threat. This is T1626.001 Device Administrator Permissions. Newer Android versions have narrowed what admin can do, so some families now prefer the next two techniques.
Accessibility abuse. Accessibility services exist so that screen readers and switch-access tools can see and interact with everything on screen. That same power lets a malicious service read every message as it is displayed, in every app, including end-to-end-encrypted ones, and capture what you type as a keylogger. Rule GS-R-021, "Accessibility service can read screen content", maps to T1417.001 Keylogging and T1513 Screen Capture. It is the single most important modern stalkerware technique, because it works around most of Android’s permission system.
Notification listener. A notification-listener service receives the content of every notification: incoming messages, two-factor codes, calendar reminders, email previews. For a watcher, this is a cheap way to read most of your conversations without touching the messaging apps. T1517 Access Notifications.
Battery-optimisation exemption. Android aggressively suspends background apps to save power. Stalkerware needs to run constantly, so the installer turns off battery optimisation for it. An exemption for an app you do not recognise is a small but useful signal, and GuestSpy lists it in the permission audit.
Boot persistence and foreground services. A receiver for the boot-completed broadcast means the app starts every time the phone restarts. A foreground service with a hidden or minimal notification keeps it alive. Neither is suspicious on its own; both are expected in a surveillance tool.
Packing and obfuscation. Some families wrap their code in a commercial packer or obfuscator so that static analysis sees less. GuestSpy notes packers in the Code section of the report; as with the other techniques, it is the combination that counts.
The five evidence levels, with worked examples
Every GuestSpy finding carries a confidence level that names which of these levels produced it. They are ordered by how certain each one makes the verdict.
Level 1: exact hash match
GuestSpy computes the SHA-256 of the installed APK and compares it with roughly 2,950 hashes of samples that researchers have analysed and attributed. If the hash matches, the file on the phone is byte-for-byte a known stalkerware sample. There is no interpretation involved.
Worked example. A scan finds a package labelled "Sync Services". Its APK hash matches a sample attributed to the mSpy family. Verdict: Known stalkerware. Danger code GS-STK-AND-7685. Confidence: Exact hash match. Severity is set from the family’s known capabilities, in this case very high. The report’s Overview reads: "This exact file is a known mSpy build." The rules that also fire, such as GS-R-014 and GS-R-021, are listed as supporting evidence, but the verdict would stand without them.
Level 2: signing-certificate match
Every Android app is signed by its developer, and the signing certificate is stable across versions and across the rebrands a vendor uses. TheTruthSpy’s family alone has used more than a dozen certificates across its brands, and all of them are in the database. If an app’s certificate SHA-1 or SHA-256 matches one of the 470+ known stalkerware signers, the app came from that vendor, regardless of what it is called or whether this specific build has ever been seen.
Worked example. An app called "WiFi Manager" has a package name not in the database and a hash not in the database. Its signing certificate, however, matches one used by TheTruthSpy builds. Verdict: Known stalkerware. Danger code GS-STK-AND-1405. Confidence: Signing-certificate match. The Identity section shows the certificate fingerprint and notes that the same certificate has signed Copy9, iSpyoo and old GuestSpy monitoring builds. This is the level that makes rebranding futile.
Level 3: package-name match
The package name is the app’s identifier on the system and on Google Play, and families tend to keep theirs even as they change labels. The database holds 600+ of them. A match is strong evidence, but it sits below a certificate match because, in principle, a package name can be reused by someone unrelated, and because a few families have used names that collide with generic strings.
Worked example. The scan finds com.lsdroid.cerberus.persona. The certificate is not one in the database (Cerberus has used several), and the hash is new. The package name matches the Cerberus family. Verdict: Known stalkerware. Danger code for the Cerberus family. Confidence: Package-name match. The Overview notes that Cerberus is sold as anti-theft software and explains why it is in the stalkerware list: it offers remote microphone activation, location tracking and SMS reading, and it supports hidden installation. If you installed it yourself as anti-theft and know it is there, the report says what it can do and leaves the decision to you.
Level 4: C2-domain match
Stalkerware has to get your data off the phone, and it does that by talking to the vendor’s servers. The database has 900+ of those domains, from api.thd.cc and a.thd.cc for mSpy to admin.flexispy.com and api.flexispy.com for FlexiSpy, hw.cab for Hoverwatch and enterprise.cerberusapp.com for Cerberus. GuestSpy extracts domains, IPs and URLs from the app’s code and resources and compares them against the list.
Worked example. A package called com.android.core.mnta is not in the database by hash, certificate or name; it is a brand-new build. Its code contains the strings a.hw.cab and account.refog.com, both Hoverwatch infrastructure. Verdict: Dangerous, raised to Known stalkerware if the heuristic rules also fire strongly. Confidence: C2-domain match. The Network indicators section highlights both domains and names the family. This is how a fresh build gets caught before anyone has fingerprinted it.
Level 5: heuristic
Nothing matched. The app is examined for behaviour instead. Each rule is a single observation, each has a weight, and the rules that fire combine into a severity score.
Worked example. A package named com.systemservice.update, label "System Service", with no entry in any list. Rules that fire: GS-R-014 hides launcher icon; GS-R-021 accessibility service can read screen content; GS-R-030 reads SMS, call log and location together; a device-admin receiver; a notification-listener service; a boot receiver; no visible activity at all. Severity 88. Verdict: Dangerous. Danger code GS-SPY-AND- with the rule-pattern number. Confidence: Heuristic. The Overview says plainly: "No known family matched. This app behaves like stalkerware: it hides from the app drawer, can read everything on screen, and collects messages, calls and location." The ATT&CK mapping shows seven techniques.
That app will never be labelled Known stalkerware on heuristics alone, however bad it looks. Known means known. But Dangerous with seven listed techniques is an answer you can act on, and if you submit a community report, it helps the next person who finds the same thing.
com.guestEvidence 12
ATT&CK mapping
MITRE ATT&CK for Mobile is the catalogue security researchers use to describe what malicious mobile software does. GuestSpy maps every rule to one or more techniques, so the report ends up describing the app’s capabilities in a vocabulary that is shared with forensic examiners, corporate security teams and the researchers who maintain the indicator database.
| Rule | What GuestSpy observed | ATT&CK technique |
|---|---|---|
GS-R-014 |
Launcher icon hidden or launcher activity disabled | T1628.001 Suppress Application Icon |
GS-R-021 |
Accessibility service can read screen content | T1417.001 Keylogging; T1513 Screen Capture |
GS-R-030 |
Reads SMS, call log and location together | T1636.004 SMS Messages; T1430 Location Tracking |
| Device-admin receiver | Holds or requests device administrator | T1626.001 Device Administrator Permissions |
| Notification listener | Service receives all notification content | T1517 Access Notifications |
| Record audio permission with background service | Can capture microphone audio while hidden | T1429 Audio Capture |
| Background precise location | Tracks location continuously | T1430 Location Tracking |
| Screenshot or media projection use | Captures the screen | T1513 Screen Capture |
Reading an ATT&CK section is quick once you know the pattern. One technique from the hiding group (T1628.001), one from the persistence group (T1626.001), and two or more from the collection group (T1636.004, T1430, T1429, T1417.001, T1513, T1517) is the signature of a complete surveillance tool. A legitimate app almost never needs techniques from all three groups.
Sync Services v2.4.1
com.guest · APK · 4.2 MB · SHA-256 7f3a9c…e21bIdentity
- Package
- com.guest
- Label
- Sync Services
- SDK
- API 19 → API 22
- Launcher icon
- none
- Signer
- CN=Unknown, O=Unknown · RSA 2048
- Valid
- 2015-03-02 → 2042-07-19
Permissions by tier
- CREAD_SMS
- CREAD_CALL_LOG
- CACCESS_BACKGROUND_LOCATION
- CRECORD_AUDIO
- CBIND_ACCESSIBILITY_SERVICE
- CBIND_DEVICE_ADMIN
Network indicators
- guestspy.com known infrastructure
- media-sync-a.thetruthspy.com known infrastructure
- api.github.com
- 69.64.81.166 known C2 IP
ATT&CK techniques
How false positives are handled
Any detection system that uses behaviour will sometimes be wrong, and the honest approach is to design for that rather than pretend it does not happen.
Confidence is shown, always.
A heuristic finding says Heuristic. It never borrows the certainty of a hash match.
Heuristic findings are capped. Without a database match, the verdict can reach Dangerous but not Known stalkerware.
Rules are listed individually. If GuestSpy flags an app and you expand the finding, you see exactly which rules fired. If one of them does not fit, you can tell. A screen reader for blind users will fire GS-R-021; it will not fire GS-R-014 or GS-R-030, and the combination will not reach a Dangerous severity.
Known legitimate uses are explained in the rule text. Each rule’s description includes what kind of app legitimately needs the capability. The accessibility rule says: "Needed by screen readers, switch-access tools, some password managers and automation apps. Not needed by an app with no visible interface."
Watchware is its own class. Visible parental-control and employee-monitoring apps are not lumped in with covert stalkerware. They get a WCH code, a lower severity and a description of what they can see, and the decision about whether they belong is left with you.
Community verdicts give context without overriding evidence. If other users have marked a package as Safe and explained why, that appears next to the automated finding. It does not change the finding, because votes can be gamed and evidence cannot.
You can tell us. Every finding has a report option. A false positive reported with a comment helps tune the rules, and because reports are moderated, a vendor cannot flood the system with "Safe" votes on their own product.
Clean means nothing in the database matched and no rule pattern fired. It is a strong result, but new families appear, and some are careful. If your suspicion is strong and the scan is clean, run the permission audit and look at the special-access categories by hand, review the devices on your Google and Apple accounts, and consider a forensic backup analysis with MVT.
What to do after a detection
GuestSpy finds something. The result card is red. What now?
Step 1: do not uninstall yet
This is counterintuitive and important. Many stalkerware apps notify the installer when they are removed, when device admin is revoked, or when the data stream stops. If the person who installed the app is someone who could harm you, the moment of removal is a moment of risk. Scanning has not changed anything on the phone and has not alerted anyone. You have time.
If you are in an abusive relationship, talk to someone before you remove the software. The Coalition Against Stalkerware at stopstalkerware.org lists support organisations by country. In the US, the National Domestic Violence Hotline is 1-800-799-7233. A local domestic-violence service can help you decide when and how to remove the app, whether to involve the police, and how to stay safe afterwards. If you can, use a device the other person has never had access to when you reach out.
Step 2: keep the evidence
Export the deep report as a PDF. It records the package name, the certificate fingerprints, the APK hash, the rules that fired, the ATT&CK techniques and the time of the scan. If you later need to show an advocate, a lawyer or the police what was on your phone, this is far more useful than a description from memory. Store it somewhere the other person cannot reach: a cloud account they do not know about, or a trusted friend.
Step 3: read the removal plan
The deep report’s Removal plan is written for that app. It knows whether the app holds device admin, which must be revoked before Android will let you uninstall; whether it runs an accessibility service, which should be disabled first; whether it has a notification listener; and whether its icon is hidden, which means you will not find it in the app drawer and must go through Settings > Apps.
- 1Evidence savedReport GSR-M3K2 exported · 12 screenshots
- 2Device admin removedSettings › Security › Device admin apps
- 3Revoke accessibility accessSettings › Accessibility › Downloaded apps › Sync Services › OffOpen this setting →
- 4Revoke notification access
- 5Force stop and uninstall
- 6Re-scan and lock accounts
Step 4: remove it, when you are ready
On recent Android (menu names vary by manufacturer, Pixel and Samsung shown):
- 1Revoke device administrator: Settings > Security & privacy > More security & privacy > Device admin apps (Pixel) or Settings > Security and privacy > Other security settings > Device admin apps (Samsung). Turn off the app.
- 2Disable the accessibility service: Settings > Accessibility > find the app under Downloaded apps or Installed apps and switch it off.
- 3Remove notification access: Settings > Notifications > Device & app notifications (Pixel) or Settings > Notifications > Advanced settings > Notification access (Samsung).
- 4Uninstall: Settings > Apps > See all apps > find the app by the name GuestSpy reported > Uninstall.
- 5If uninstall is greyed out and the app is not a device admin, it may have been installed in a work profile or as a system app by someone with deeper access; the Android removal guide covers those cases and when a factory reset is the right answer.
Step 5: close the doors it came through
Removing the app is not the end. The person who installed it had your passcode and possibly your account passwords.
Change your phone passcode and your Google account password, from a device they cannot see.
Review devices signed into your Google account and remove any you do not recognise.
Turn on two-factor authentication, and make sure the backup phone number and email are yours alone.
Check Settings > Apps > Special app access > Install unknown apps and turn it off for everything.
Check whether anyone else has a Google Family Link, Find My Device or shared-location arrangement with your account.
Consider that a factory reset removes the app but does nothing about account access. Both matter.
Step 6: tell the next person
If the finding was accurate, a community report takes a minute and helps anyone who finds the same package after you. If it was a false positive, say so; it improves the rules.
Why evidence matters more than a red icon
The difference between "Threat found: Trojan.Generic" and a GuestSpy finding is not cosmetic. When you are trying to understand whether someone you live with has been reading your messages, a vague label gives you nothing to act on, nothing to show anyone, and no way to tell whether the scanner is right. A finding that says Known stalkerware, GS-STK-AND-7685, certificate match, severity 94, with the rules and techniques laid out beneath it, is something you can read, check, keep and explain. It respects the fact that you are the one who has to decide what to do next.
Run a free scan right now
Drop an APK, a file, your installed-apps list or an iPhone configuration profile into the GuestSpy Web Scanner. Everything is analysed inside your browser. Nothing is uploaded.
Frequently asked questions
Can stalkerware be installed on my phone remotely?
On Android, almost never. The families in the database need someone to have physical access to the unlocked phone, enable installation from unknown sources, download the app and grant its permissions. A link in a message that installs stalkerware by itself is not how these products work. The practical consequence is that if stalkerware is on your phone, someone who had your phone put it there.
Does GuestSpy detect stalkerware on iPhone?
iPhone stalkerware in the Android sense is rare, because iOS does not let apps hide or read other apps’ data, and no app, GuestSpy included, can list what is installed. Monitoring on iPhone usually happens through a shared Apple Account, a configuration profile, or an iCloud backup the other person can log into. The iPhone security check covers each of those.
My scan found watchware. Is that bad?
Not necessarily. Watchware is monitoring software that is visible: a parental-control app, an employee-management tool. If you or your employer installed it knowingly, the report simply describes what it can see. If you did not install it and do not know who did, treat it as seriously as you would stalkerware, because some watchware grants the watcher almost as much.
Will removing stalkerware delete the data it already sent?
No. Everything the app uploaded is on the vendor’s servers and visible to whoever holds the account. Removal stops future collection. Changing your passwords and reviewing your accounts limits what else they can reach. Legal routes for forcing deletion vary by country, and a support organisation can advise.
Why does the old GuestSpy app appear in your own database?
Because it belongs there. The GuestSpy name was once used for a monitoring app in the TheTruthSpy family. The product has been rebuilt as protection software, and old GuestSpy monitoring builds are flagged under GS-STK-AND-1405 without exception. We would rather be the scanner that flags its own past than one that quietly leaves a gap.