How to find and remove spyware from an Android phone (complete guide)

The Settings walk-through catches most things, but a well-built stalkerware app can hide from the app list on some phones, and its name tells you nothing about what it does. The reliable way to know what is really installed is to ask Android directly over a USB cable, then let the GuestSpy Web Scanner compare every package against its database of 600+ stalkerware package names, 470+ signing certificates and roughly 2,950 known sample hashes.

A web page cannot reach into your phone on its own. You pull the list; the scanner reads it. Nothing is uploaded: the check runs in your browser, and files you drop in never leave your computer.

You need: a computer (Windows, macOS or Linux), a USB cable, and the free Android platform tools from Google, which include a program called adb.

Step 1: Turn on USB debugging

Settings > About phone > tap Build number seven times. You will see "You are now a developer". Then go to Settings > System > Developer options (Pixel) or Settings > Developer options (Samsung) and turn on USB debugging.

Yes, this is the same setting we will tell you to turn off at the end. Turning it on temporarily is fine.

Step 2: Connect and confirm

Plug the phone into the computer. On the phone, tap Allow on the "Allow USB debugging?" prompt. On the computer, open a terminal (Command Prompt or PowerShell on Windows, Terminal on Mac/Linux), go to the folder where you unpacked platform-tools, and run:

adb devices

You should see your phone’s serial number followed by device. If it says unauthorized, look at the phone and accept the prompt.

Step 3: List third-party packages with their file paths

adb shell pm list packages -f -3

pm is Android’s package manager. -3 means third-party only (not preinstalled), and -f shows the file path of each APK. Each line looks like:

package:/data/app/~~abc123==/com.example.app-xyz/base.apk=com.example.app

The part after the last = is the package name. Copy the whole output and save it as a text file. This is the list you will drop into GuestSpy.

Step 4: Include uninstalled-but-lingering packages

adb shell pm list packages -u

The -u flag includes packages that have been uninstalled but still have data on the device, which can reveal something that was removed recently, perhaps by the person who installed it when they suspected you were catching on. Save this output too.

Step 5: Look at one package in detail

For any package you want to understand, run:

adb shell dumpsys package com.example.app

This prints a lot. The useful parts are requested permissions, install permissions and runtime permissions (what the app asked for and what it was granted), installerPackageName (which shows null or a browser or file manager for sideloaded apps, and com.android.vending for Play Store apps), and firstInstallTime, which tells you the exact date and time the app arrived. That timestamp alone can be the most important fact you learn today.

Step 6: Get the actual APK file

adb shell pm path com.example.app

This returns the path to the installed APK, for example package:/data/app/~~abc123==/com.example.app-xyz/base.apk. Then pull it to your computer:

adb pull /data/app/~~abc123==/com.example.app-xyz/base.apk suspicious.apk

You now have the exact file that is running on your phone, which is also the best possible evidence to keep.

Step 7: Drop everything into the GuestSpy Web Scanner

Open the Web Scanner, choose Installed-apps list check, and paste or drop the text output from steps 3 and 4. The scanner matches every package name against the database and shows a verdict next to each one: Clean, Low risk, Suspicious, Dangerous or Known stalkerware.

🔒 guestspy.com/scanner#pkglist

212

apps

2

stalkerware

1

watchware

3

suspicious

Stalkerware	com.android.core.monitor Hoverwatch · GS-STK-AND-7843 · sideloaded	GS-R-070 system-name impostor · GS-R-030 7 surveillance permissions
Stalkerware	com.systemservice TheTruthSpy · GS-STK-AND-1405	installer: null · 2 components disabled
Watchware	com.wondershare.famisafe FamiSafe · GS-WCH-AND-0487	Play Store · visible icon
Suspicious	com.wifi.sync.service	GS-R-072 generic system name · sideloaded · installed 3 days ago
OK	com.whatsapp	no findings

For any package that is not Clean, or any package you simply do not recognise, switch to App (APK) scan and drop in the APK you pulled in step 6. The package-name check is fast but only catches apps that use a known name. The APK scan looks at the signing certificate, the file hash, the permissions, the components and the embedded domains, so it catches renamed or repackaged builds too.

The point of GuestSpy is that it shows its work. A verdict without evidence is just someone else’s opinion. Here is how to read what you get back.

🔒 guestspy.com/scanner#report-GSR-M3K2

Known stalkerware Signing-certificate match

Sync Services v2.4.1

com.guest · APK · 4.2 MB · SHA-256 7f3a9c…e21b

Identity

Package

com.guest

Label

Sync Services

SDK

API 19 → API 22

Launcher icon

none

Signer

CN=Unknown, O=Unknown · RSA 2048

Valid

2015-03-02 → 2042-07-19

Permissions by tier

Critical 9High 6Medium 7Low 5

• CREAD_SMS
• CREAD_CALL_LOG
• CACCESS_BACKGROUND_LOCATION
• CRECORD_AUDIO
• CBIND_ACCESSIBILITY_SERVICE
• CBIND_DEVICE_ADMIN

Network indicators

• guestspy.com known infrastructure
• media-sync-a.thetruthspy.com known infrastructure
• api.github.com
• 69.64.81.166 known C2 IP

ATT&CK techniques

T1430Location TrackingT1636.004SMS MessagesT1417.001KeyloggingT1628.001Suppress App IconT1626.001Device Administrator

Overview

The top of the report gives the verdict, the danger code, a severity score from 0 to 100 and the confidence. Confidence depends on how the match was made, from strongest to weakest:

1. 1

   Exact hash match

   the file is byte-for-byte a known sample.
2. 2

   Signing-certificate match

   the app was signed with a certificate used by a known stalkerware vendor, even if the file itself is new.
3. 3

   Package-name match

   the package name is in the database.
4. 4

   C2-domain match

   the app contains the address of a known command-and-control server.
5. 5

   Heuristic

   no database match, but the behaviour fits.

A danger code like GS-STK-AND-1405 reads as: GuestSpy, class STK (stalkerware), platform AND (Android), family number 1405. That particular code is the TheTruthSpy family, which includes several rebranded apps sold under different names, among them old GuestSpy monitoring builds using the package com.guest. If you see this code, the report will say so in plain English, and we do not soften it because of the name.

Identity

Package name, version, minimum and target SDK, the signer certificate’s SHA-1 and SHA-256 fingerprints and its issuer. Stalkerware certificates are often self-signed with nonsense or copied issuer names. A target SDK far below the current Android version is a hint that the app is avoiding newer permission restrictions.

Permissions by risk tier

Every requested permission, sorted into tiers. On its own, "read SMS" is not proof of anything; your messaging app needs it. The report looks at combinations. Rule GS-R-030 ("Reads SMS + call log + location together") fires when an app wants all three, which almost no honest app does.

Components

This is where hidden behaviour shows up. The report lists services, broadcast receivers, accessibility services, device-admin receivers, notification listeners, boot receivers and whether the launcher icon is hidden. GS-R-014 ("Hides launcher icon") is a near-certain stalkerware tell, because legitimate apps want you to find them. A boot receiver means the app restarts itself after every reboot.

Network indicators

Domains, IP addresses and URLs found inside the app, with any matches against the 900+ known command-and-control domains highlighted. This is often where you learn which web dashboard your data was being sent to.

Code

Number of dex files, native libraries and whether a packer or obfuscator was used. Packing is not proof of malice, but stalkerware uses it heavily to dodge antivirus signatures.

ATT&CK mapping

Each finding is mapped to a MITRE ATT&CK for Mobile technique, such as T1430 Location Tracking, T1429 Audio Capture, T1636.004 SMS Messages, T1417.001 Keylogging, T1513 Screen Capture, T1517 Access Notifications, T1628.001 Suppress Application Icon and T1626.001 Device Administrator Permissions. If you take the report to a lawyer, the police or an IT department, this mapping gives them a vocabulary they already understand.

Removal plan

A step list specific to what was found: for instance, "revoke device admin first" if a device-admin receiver is present, or "revoke accessibility" if an accessibility service is declared. The generic version of that plan is the next section of this guide.

Community verdicts

What other users who scanned the same package or hash reported, moderated before publishing. If nobody has reported it yet, the section is empty; we never pre-fill it.

Here is the order that works. The order matters, because some of these steps protect the app from the later ones.

9:41

‹Guided removal3 / 6

Safety mode on. The app will not be notified or stopped until you confirm the last step.

1. 1
   Evidence savedReport GSR-M3K2 exported · 12 screenshots
2. 2
   Device admin removedSettings › Security › Device admin apps
3. 3
   Revoke accessibility accessSettings › Accessibility › Downloaded apps › Sync Services › OffOpen this setting →
4. 4
   Revoke notification access
5. 5
   Force stop and uninstall
6. 6
   Re-scan and lock accounts

I did this, next

Step 1: Revoke device admin

If the app appears under Device admin apps, you cannot uninstall it until you turn that off. Go to Settings > Security & privacy > More security & privacy > Device admin apps (Pixel) or Settings > Security and privacy > Other security settings > Device admin apps (Samsung), tap the app and choose Deactivate or turn the toggle off. Some stalkerware shows a scary warning here, or even tries to lock the screen. Ignore the warning and proceed.

Step 2: Revoke accessibility and notification access

Settings > Accessibility > Downloaded apps, tap the app, turn it off. Then Notification access, turn it off. Then Special app access > Display over other apps, turn it off. This cuts the app off from your screen and messages immediately, even before it is uninstalled.

Step 3: Force stop

Settings > Apps > the app > Force stop. This ends its running services so it cannot interfere with the next step.

Step 4: Uninstall

On the same App info page, tap Uninstall. If the button is greyed out, device admin is probably still active; go back to step 1. If the app is listed as a system app and the button says Disable instead, it was either installed into the system partition (rare, needs a rooted phone) or installed by a management profile; see the work-profile step below.

Step 5: For stubborn apps, use adb

If the app refuses to uninstall or reappears, connect the phone to the computer with USB debugging on and run:

adb shell pm uninstall -k --user 0 com.example.app

--user 0 targets the main user profile, which lets you remove apps that the normal Uninstall button will not. -k keeps the app’s data directory, which is useful if you want to preserve evidence; leave it out to remove the data too. If the command says Success, the app is gone for that user. If it says DELETE_FAILED_INTERNAL_ERROR or similar, the app is on the system partition and a factory reset is the realistic next step.

Step 6: Safe mode

If the phone misbehaves while you work (screen locks itself, settings close, the app keeps re-opening), boot into Safe mode. Hold the power button, then press and hold the Power off option on screen until you see "Reboot to safe mode" and confirm. In Safe mode only preinstalled apps run, so stalkerware cannot fight back. Uninstall it from Settings > Apps as normal, then restart.

Step 7: Remove unknown accounts

Settings > Passwords & accounts (or Accounts and backup > Manage accounts), tap each account you do not recognise and remove it. Some stalkerware syncs through a Google account the installer added.

Step 8: Check work profile, Knox and Family Link

If a work profile exists that you did not create, remove it: Settings > Accounts > Work profile > Remove work profile (Pixel) or Settings > Accounts and backup > Manage accounts > Work profile (Samsung). If the phone shows "This device is managed by your organisation" and you have no organisation, a management app is installed; you may need a factory reset to remove it. For Family Link supervision on an adult’s phone, Settings > Digital Wellbeing & parental controls > Parental controls > Stop supervision; if that is locked, the reset is again the route.

Step 9: Verify

Run adb shell pm list packages -f -3 again and drop the output into the scanner. The package should be gone. Reboot, and check once more, because a boot receiver in a leftover component can reinstall some families.

Step 10: Factory reset, if you need certainty

A factory reset wipes every app and setting and returns the phone to how it was out of the box. It removes any stalkerware installed as a normal app, and anything installed via management profiles, Family Link, or sideloading. For most people it is the cleanest option, and if you cannot identify exactly what is on the phone, it is the safest.

Settings > System > Reset options > Erase all data (factory reset) on Pixel; Settings > General management > Reset > Factory data reset on Samsung.

What a factory reset does not fix:

• Restoring from backup. If you restore your Google backup afterwards, Android may reinstall the apps that were on the phone, including the stalkerware, especially if it was installed through the Play Store under a developer-style listing. Set the phone up fresh, sign in, and reinstall apps by hand. Copy photos and documents across, not "everything".
• Your SIM. A reset does not touch the SIM card. If someone has access to your mobile account (SIM swap, call forwarding set up at the carrier, an added authorised user), they still have it. Call your carrier, set an account PIN, and check for call-forwarding or "divert" settings with *#21# dialled as a call, which on most networks shows forwarding status.
• Compromised cloud accounts. If the person knows your Google password, a clean phone changes nothing; they can still read your mail, see your location history and restore your backup to their own phone. The hardening checklist below is not optional.
• A rooted phone or a modified system partition. Rare, but if the phone was rooted and the spyware was baked into the system image, a factory reset may leave it in place. If GuestSpy shows a system-partition install path (/system/ or /product/ rather than /data/app/) for a stalkerware package, treat the phone as untrustworthy. Reflashing the official firmware, or replacing the phone, is the honest advice.
• Other devices. Your tablet, laptop, smartwatch and old phones signed into the same accounts need the same checks.

Installing monitoring software on another adult’s phone without consent is illegal in most countries. Whether you report it is your decision, and a domestic-violence advocate can help you weigh it. If you think you might, preserve evidence before you remove anything, because the evidence disappears when the app does.

What to keep:

Do not try to log into the stalkerware vendor’s dashboard yourself, and do not confront the person with the evidence before you have a plan. A forensic examiner, which some police forces and specialist charities can arrange, can make a full image of the phone that is admissible as evidence; a factory reset makes that impossible. If evidence matters more than speed, keep the phone powered on, in airplane mode, and untouched until you have spoken to someone.

Run a free scan right now

Drop an APK, a file, your installed-apps list or an iPhone configuration profile into the GuestSpy Web Scanner. Everything is analysed inside your browser. Nothing is uploaded.

Open the Web ScannerGet the app