Subscribe & Save 20% off Premium or Families plans
By subscribing, you agree to receive marketing communications regarding industry news and research, educational resources, and LastPass products and services. The processing of your personal data in accordance with the LastPass Privacy Policy. You can unsubscribe from marketing communications at any time.
ProSpy and ToSpy are two of the newest and most insidious Android spyware strains in 2025.
Slavisa Milanov is the face of independent journalists being targeted by spyware campaigns.
Spyware is the digital ninja stealing your passwords, secrets, and confidential files without leaving a trace.
There are six (6) ways to prevent spyware from getting on your Android (#6 is ignored by almost everyone).
LastPass complements anti-spyware tools to protect your most sensitive data.
Simple steps like checking for unusual app permissions, lagging device performance, sudden freezes, and excessive data usage are key to detecting spyware on your Android.
But what happens when your government plants spyware – secret software that tracks and steals your data – on your phone?
Slavisa Milanov’s story reveals the importance of vigilance.
On a cold morning in February 2024, Milanov, a Serbian independent journalist, was on his way to the city of Pirot.
He wasn’t drinking.
Yet he was arrested for driving under the influence.
At the police station, he was forced to take both breathalyzer and psychoactive substance tests – which came back negative. Milanov was then taken to a second police station for interrogation, where he was accused of transporting wanted persons across the Bulgarian border.
The charge was preposterous, and Milanov denied it.
After his release, Milanov noticed that his Android phone had been tampered with. And what he discovered set off an international firestorm.
But first, let’s talk about what spyware actually does to your life.
What is spyware on Android phones?
Spyware is malware that can read your texts & search history, screen your calls, change your permissions settings, and send whatever you do on your phone to third parties.
Here’s what makes 2025 spyware particularly dangerous: It hides in plain sight.
Recent campaigns in October 2025 feature two new spyware families targeting residents of the UAE (United Arab Emirates).
The spyware masqueraded as secure communication apps. The first, Android/Spy.ProSpy posed as upgrades for both the Signal and ToTok apps, while the second, Android/Spy.ToSpy impersonated the ToTok app itself (which is largely defunct and no longer found in official app stores).
The cruel irony is that people downloaded these apps because they were trying to be more secure.
When downloaded, both apps were found to continuously exfiltrate data.
But, if you’re like most people, you’re probably thinking, “Ok, so someone might see my texts or favorite YouTube channels. That’s invasive, but how much damage can chats with (insert your favorite person) and the latest TikTok dance craze really do?”
Spyware like ProSpy and ToSpy don’t just see your texts and browsing activity. They can also record your voice calls, capture videos through your camera, copy every document you open, screenshot your banking app the moment you log in, and watch when you enter PINs and passwords.
And they can send all of this to third parties (without your consent).
The question is: What can someone do with complete access to your digital life?
What are the different types of spyware and what can they do?
When spyware gains entry, it can invade your privacy through an arsenal of capabilities, such as:
- Keyloggers that record your keystrokes to steal your passwords
- Stalkerware that monitors your location, calls, emails, texts, photos, and internet browsing activity
- Adware that floods your browser and sells your data to advertisers
- Rootkits that maintain persistence on your device to spy on everything pertaining to your Android, including files, network traffic, and system activity
- Banking trojans that spy on your logins to steal your credentials
One of the most dangerous types of stalkerware is TheTruthSpy, which has exposed photographs of children the app took on the internet. The app has also been weaponized by abusive romantic partners to spy on their victims.
In 2022, TechCrunch uncovered massive amounts of data found in TheTruthSpy’s core database, which contained records of every Android device compromised.
Just from six weeks of data, TechCrunch found 1.2 million text messages, 473,211 video & photo records, and 4.42 million call logs, some of which came from children’s phones. All were obtained without consent.
Meanwhile, spyware such as Hermit, Predator, and Pegasus are being weaponized for cyber espionage as we speak.
Hermit, for instance, can read notifications, upload files, take screenshots, and even re-route calls.
Alarmingly, Google found that repressive governments in Kazakhstan and Syria have used Hermit to target activists, journalists, and political opponents.
Meanwhile, mercenary spyware like Predator and Pegasus have been weaponized by the world’s most repressive regimes. And their use is spreading to the private sector. Predator, for instance, has recently targeted executives in private sector firms in finance, real estate, and logistics & transportation.
If you’re doing business in 2025, you can block unauthorized SaaS apps that are common entry points for spyware with LastPass SaaS monitoring + SaaS Protect. Try it today with a free trial of Business Max (no credit card required).
Why is spyware a threat to Android devices?
Despite security improvements by manufacturers, spyware remains a persistent threat. This year, spyware rose 147% on Android devices, with a notable spike in February and March.
Even more alarming, April and May saw a 692% spike in SMS-based malware.
Remember Slavisa Milanov?
After getting his phone back, he discovered that his data and Wi-Fi settings had been turned off. He turned to Amnesty International’s forensic team, who launched an investigation.
Their findings? Milanov’s phone was infected with not one, but two pieces of malware.
- Cellebrite: to unlock his Android with Universal Forensic Extraction Device (UFED) technology
- NoviSpy (spyware): to access his messages, contacts, location, camera, and microphone
Forensic evidence showed that Milanov’s phone was infected while he was in custody.
According to Amnesty’s 87-page report on surveillance, the Serbian Security Intelligence Agency has been weaponizing spyware like NoviSpy, Predator, and Pegasus since at least 2014. This and similar assaults on privacy and freedom of speech by other rogue nations have led sixteen (16) countries, including the United States, to call for international spyware regulations.
Sadly, Milanov remains a targeted figure today. He insists that "safety is at stake. Whatever happens to me, or anyone close to me, I will hold the state responsible for it.”
Milanov isn’t the only one at risk.
In 2025, the global cost of cyber-attacks is expected to reach US $10.5 trillion (that’s roughly $20 million lost every single minute).
And a significant portion of that comes from Android spyware.
Think about what’s on your phone right now:
- Photos of your driver’s license
- Images of your passport and Social Security card
- Tax documents you downloaded to review
- Medical records from your healthcare portal
- Banking, ecommerce, and subscription service passwords
With this information, attackers can:
- Open credit cards in your name
- Take out loans you’ll be liable for
- Commit financial fraud with your identity
- File fraudulent tax returns and steal your refund
- Access your health insurance info to get treatments and prescriptions you’re billed for
Depending on the type of identity theft, it can take weeks or months to resolve. Synthetic identity – the fastest growing and most expensive type of identity theft - is the most damaging and can take years to recover.
If you own a business, the risks multiply. In December 2024, mobile security firm iVerify found 11 new Pegasus infections on 18,000 devices. And in May of that year, the firm democratized mobile threat hunting by launching a $1 app that allowed consumers to scan their devices for spyware like Pegasus.
Around 3,000 people scanned their devices, and 2.5 Pegasus infections were found for every 1000 phones scanned.
Why target businesses?
Because spyware on corporate or BYOD phones mean attackers have access to:
- Merger and acquisition discussions
- Trade secrets and intellectual property
- Your client lists and information
- Confidential business proposals
- Proprietary research data
- Competitive pricing strategies
The result is disrupted operations, legal liabilities (from failure to protect sensitive data), and reputational damage. And the loss of trust can bring your business to its knees.
Doing nothing can cost you everything: Get effortless security with LastPass SaaS Monitoring + SaaS Protect with a free trial of Business Max (no credit card required).
How did spyware get on my Android and how can I prevent it from happening?
Now that you know what’s at risk, here’s what most people ask next, “How did spyware get on my Android in the first place?”
Understanding how it arrives is the first step in preventing spyware on your Android.
The truth is spyware can get on your device because of a split-second decision:
- A link you clicked absentmindedly
- An app you downloaded because someone sent you an ad on social media
- A permission you granted during a busy moment
It happens to the best of us. But the good news is this: Mindful choices are the smartest way to keep your Android secure. Below, we talk about how spyware infections happen and how you can prevent them from unleashing chaos in your world.
#1 You downloaded a “security update” that wasn’t
This is the most common way spyware is infecting Android devices in 2025. Spyware is distributed primarily through phishing links on platforms like Telegram.
You may get a message that says your Android needs an “urgent security update” for your Signal app. Don’t fall for it.
It may be spyware in disguise. For example, the malicious ToTok app displays a welcome screen similar to the one for the real (now largely defunct) app. So, you’ll see two ToTok icons. One is real. One is stealing everything on your Android.
And you have no idea which is spyware.
Safeguard: Ignore “urgent update alert” pop-ups. If you’ve enabled automatic app updates in the Google Play Store, Signal should update automatically.
#2 You granted permissions without reading what they actually do
Perhaps an app requests access to your contacts “to help you connect with friends.”
Or it requests access to your files “to allow photo sharing.”
Or it requests access to notifications “to enable alerts.”
All of these sound reasonable, so you tap “Allow.”
What you don’t realize is that “access to notifications” means the app can read your incoming texts and two-factor authentication codes. “Access to files” means it can copy your tax returns and passport photos. And “accessibility services” means it can record your device screen and control your Android.
Safeguard: Be careful what permissions you allow on your Android.
#3 You installed an app from Google Play and assumed it was safe
Even official app stores aren’t bulletproof.
In 2024, Malwarebytes detected more than 22,800 phishing apps on Android. Of those, 5,200 could subvert SMS-based multi-factor authentication. And another 4,800 could read information from an Android’s “Notifications” bar to obtain the same info.
Safeguard: Be careful what you download. Research the app’s vendor and closely scrutinize the app’s privacy policy, permission requests, user reviews, and overall public sentiment. For example, a high number of downloads over a long period is a good sign an app is widely trusted.
#4 Your phone came with spyware already installed
This is perhaps the most disturbing cause of all.
You never clicked a shady link, granted any odd permissions, or downloaded any suspicious attachments.
But the spyware was already there when you turned on your phone for the first time.
More than 2,600 users in several countries have encountered spyware on counterfeit versions of popular smartphone models.
These are models sold at outrageously low prices and pre-loaded with Triada malware. Triada has spyware, crypto mining, and data exfiltration capabilities. It's primarily focused on stealing banking and payment login credentials.
Safeguard: That “amazing deal” for a counterfeit version of the newest Android may come with an unwanted “bonus” like Triada. Only purchase Androids from official sources.
You can also unlock credential security with a free trial of either LastPass Premium (for consumers) or LastPass Business (for organizations).
No credit card registration is required, and you get advanced MFA, military-grade encryption, and Dark Web Monitoring to ensure your email addresses are tracked 24/7.
What this means for you:
- Advanced MFA for consumers and businesses add another layer of protection to prevent account takeovers.
- Dark Web Monitoring tracks your email addresses 24/7. If any are found on Dark Web forums, you get an immediate alert so you can update your passwords and login credentials before attackers can act.
#5 You connected to public Wi-Fi and visited the wrong website
You’re at your favorite coffee shop and connect to the free Wi-Fi while waiting for your pastries and coffee.
An ad appears, telling you that your Android needs an “urgent security update.” Sound familiar?
Public Wi-Fi at malls, coffee shops, hotels, and airports can put your Android at risk for spyware, man-in-the-middle attacks, and credential-stealing malware.
Safeguard: Public Wi-Fi can be a vector for spyware. So, be cautious about responding to “alerts" while surfing on public Wi-Fi.
#6 You ignore the warning about “unknown sources”
Every time you try to install an app from outside Google Play, Android shows you a warning that reads something like this: “Installing apps from unknown sources can put your device and data at risk.”
But since you’ve seen it before, you decide to dismiss it.
Don’t do it. Installing apps from unofficial sources can put you at risk for spyware.
Safeguard: Remember there’s a reason you’re seeing that warning. When you bypass it, you’re removing one of Android’s key security protections.
How to tell if spyware is on your phone
Wondering how to tell if you have spyware on your phone?
Although spyware is designed to hide in plain sight, there are key signs to indicate you may have a potential spyware infection on your hands.
#1 Unusually fast battery drainage or overheating
The first sign is overheating or unusual battery drainage. While this can have natural causes such as high usage, it can also be a symptom of spyware.
#2 Excessive data usage despite normal activity levels
Another sign to look for is excessive data usage without an apparent cause. Check system settings to see where, how, and why data is being used.
If data usage doesn’t make sense, it’s time to take a deeper look.
#3 Unfamiliar new apps or icons on your device
Finally, look for unfamiliar apps or icons on your device.
Look at unfamiliar app behavior, as well.
For example: Does your phone camera or mic constantly turn on? Do you hear noises or an echo during a call? And are you suddenly getting unusual messages, pop-ups, or texts?
These are classic signs of a spyware infection.
#4 Frequent, intrusive pop-ups about “urgent” security updates
Picture this: Your Android suddenly explodes with a barrage of pop-ups. These aren’t the ones advertising sales at your favorite retail store.
Instead, you get big, red letters screaming at you about viruses on your computer and (you guessed it) the need for an “urgent security update.”
The pop-up is designed to make you feel cornered and panicked (or at the very least, annoyed).
This is a classic social engineering attack designed to bait you into acting quickly and clicking anything to make the pop up go away, so the attackers can get spyware on your device.
#5 Performance lags and sudden freezes
Do you have one of the newest Android models on the market? If so, performance lags or freezes that come out of nowhere should be cause for concern. They may be signs your Android has been infected with spyware.
But how can you tell if your Android has spyware for sure? That’s the question we answer below.
How to Detect Spyware on Android phone
You aren’t alone if you’re wondering, “How do I find spyware on my Android?” On Google, this question returns more than 10 million results.
To detect spyware on your Android phone:
- Use industry-leading anti-spyware tools
- Check settings and permissions for unusual app behavior
Use industry-recommended anti-spyware tools
As cyber-attacks increase, anti-spyware tools can be a critical resource. These products can both detect and remove spyware.
Norton 360, for example, can scan over 600,000 files in under 10 minutes and then remove any malware it finds.
Both free and paid options are available. In the FAQ section below, we reveal the best antispyware apps for 2025.
Check for suspicious permissions
Always check app permissions. In the Apps section, look for Special Access or Advanced settings.
You’ll want to disable all-files access for apps that don’t need it or revoke excessive permissions unrelated to the app’s core functions.
How to get rid of spyware on Android
Uninstall unwanted apps
Start by uninstalling any unfamiliar or suspicious apps.
Also, you may want to consider uninstalling any apps you rarely use, as that increases the potential attack surface.
To uninstall an app, head to Settings > Apps on your Android. Scroll down until you find an unfamiliar app, tap it, and then select Uninstall.
If you see two apps with the same name, one may be a fake app hiding spyware (remember the malicious ToTok app?).
You’ll want to delete both and then install the official app from the Google Play Store.
Reset your device to factory settings
If all else fails, reset your device to factory settings. This erases all data and apps.
However, if you do choose a factory reset, be sure to back up your files to avoid losing critical information.
How to detect and remove Pegasus (and other) spyware on Android
If you value your privacy and security, Pegasus is no ordinary threat. Designed by the NSO Group, it’s often used by repressive governments to target journalists, human rights activists, and anyone they deem a threat to their power.
The top vectors for Pegasus are social engineering techniques like baiting or pretexting, and zero click exploits that require no user interaction.
As for detecting and removing Pegasus, this is best done by security professionals. The best tool is the Mobile Verification Toolkit, an open-source solution for mobile forensic analysis. However, it is command-line based and involves considerable expertise to implement. So, a DIY approach isn’t recommended here.
If, however, you wanted to remove spyware (stalkerware) like Cocospy or Spyic, your first step is to check whether they’re installed on your phone. You can do this by entering ✱✱001✱✱ on your Android phone app’s keypad and then pressing the “call” button to see if the apps appear on-screen.
If they do, you have two options to remove them: Follow TechCrunch’s 2025 spyware removal process for a DIY option or employ Norton’s spyware and virus removal services.
Disclaimer: DIY spyware removal options come with risks. If in doubt, LastPass recommends consulting with security professionals to formulate the best solutions for your use case.
Sources
https://www.article19.org/resources/serbia-investigate-surveillance-of-journalists-and-sources-now/
https://europeancorrespondent.com/en/r/the-chilling-truth-behind-serbias-surveillance-state
https://www.eset.com/us/about/newsroom/research/eset-research-new-spyware-messaging-apps-users-uae/
https://www.darkreading.com/endpoint-security/counterfeit-phones-infected-triada-malware
https://us.norton.com/blog/mobile/how-to-detect-spyware-on-android-phones
https://us.norton.com/blog/emerging-threats/pegasus-spyware
https://www.fortinet.com/resources/cyberglossary/spyware
https://cybersrcc.com/2022/07/04/hermit-spyware
https://cybersecuritynews.com/pegasus-spyware-used-widely-to-target-individuals/
https://techcrunch.com/2022/10/26/inside-thetruthspy-stalkerware/
FAQs: How to detect and remove spyware from your Android phone
The answer is: most of the time. It’s important to know that advanced firmware or rootkit-level spyware can survive a reset. So, you’ll need professional help if your Android is infected with one of these.
If, however, your spyware comes from a phishing link or suspicious app, a factory reset will likely solve the issue. After a factory reset, be sure to:
- Update your OS to the latest version
- Install a reputable anti-virus and anti-spyware solution
- Manually install only the apps you need rather than installing from backup, which could risk re-infecting your device
Experts at AllAboutCookies recommend spyware detection tools like Bitdefender, McAfee, and Norton for their strong detection rates, regular updates, and tested protection against malware.
These are well-established apps from reputable vendors.
You can find Android spyware detection apps with good customer support from trusted sources like the Google Play Store. Official stores ensure you receive legitimate apps, timely updates, and access to developer support.
According to Safety Detectives, several Android security apps include spyware detection features, notably Bitdefender Total Security, TotalAV, Avira, and Norton 360. These apps offer features that include:
- Malware scanning
- Real-time threat alerts
- Parental controls
- Adware, keylogger, and ransomware removal
According to PCMAG, these solutions have the highest user ratings for Android spyware detection:
- Bitdefender Total Security
- Norton 360 Deluxe
- Avast
- McAfee
These apps combine effective spyware detection with overall antivirus capabilities to shield your device from multiple threats.
Users praise their ease of use, regular updates, and proven track records. Choosing top-rated apps enhances your chances of detecting and removing spyware quickly (and safely).
Subscribe & Save 20% off Premium or Families plans
By subscribing, you agree to receive marketing communications regarding industry news and research, educational resources, and LastPass products and services. The processing of your personal data in accordance with the LastPass Privacy Policy. You can unsubscribe from marketing communications at any time.
