Watchware

MicrosoftFamilySafe

MicrosoftFamilySafe is a monitoring (watchware) app tracked by GuestSpy under danger code GS-WCH-AND-2457.

MicrosoftFamilySafe is classified as watchware: a monitoring or parental-control product that normally shows an icon and tells the device owner it is installed. It is not hidden malware, but it still gives another person access to the phone’s activity, so GuestSpy reports it and lets you decide whether that access is expected.

Danger codeGS-WCH-AND-2457
ClassWatchware
PlatformAndroid
Known samples0
Package names (1)
  • com.microsoft.familysafety
Domains (dashboard, download, C2) (4)
  • family.microsoft.com
  • location.family.microsoft.com
  • mobileaggregator.family.microsoft.com
  • safedriving.family.microsoft.com

How GuestSpy detects it

The Web Scanner and the GuestSpy apps match this family on up to five levels of evidence. Any one of them is enough for a verdict; the stronger the level, the higher the confidence shown in the report.

  • Package name: 1 known package identifier.
  • Network indicators: 4 domains used for its dashboard, downloads or command-and-control traffic.
  • Behaviour rules: the heuristic rules (GS-R-0xx) that catch hidden icons, accessibility abuse, device-admin persistence and surveillance permission combinations, which also catch new builds that have not been seen before.

If GuestSpy reports this on your phone

Safety first. Removing monitoring software can alert the person who installed it. If that person could hurt you, make a plan before you remove anything: talk to someone you trust, a local domestic-violence service or the resources at stopstalkerware.org. In the US the National Domestic Violence Hotline is 1-800-799-7233.
  1. Preserve evidence if you may need it: screenshots of the app, its permissions, the report from GuestSpy, dates.
  2. Remove device-admin rights: Settings › Security › Device admin apps (names vary by manufacturer). Deactivate the app so Android lets you uninstall it.
  3. Revoke accessibility and notification access: Settings › Accessibility › Downloaded apps, and Settings › Notifications › Device & app notifications / Notification access.
  4. Force stop and uninstall from Settings › Apps. If "Uninstall" is greyed out, use Safe mode or adb shell pm uninstall -k --user 0 <package>.
  5. Check accounts and sharing: unknown Google accounts, Find My Device sharing, Family Link, work profiles.
  6. Re-scan with GuestSpy, then change your passwords from a device you trust and turn on two-factor authentication with an authenticator app.

Because this is a visible monitoring product, it may have been installed with your knowledge (for example by a parent or employer on a device they manage). If that access is expected, no action is needed. If it is not, follow the steps above.

The full walkthrough is in the Android removal guide and the iPhone guide.

Indicators are drawn from the open-source stalkerware indicator database maintained by Echap (CC-BY 4.0) and from GuestSpy research. Indicator lists are never perfect; if you believe an entry is wrong, use the community report form on the scanner page.