How to Find Hidden Spy Apps on Android: Scanning & Removal

Last Updated: June 6, 2022 Tested

Do you suspect your Android phone or tablet has hidden spy apps on it? Spyware can take many forms including keyloggers, trojans, adware, tracking cookies, and commercial spyware. Spyware is dangerous because it attempts to steal your data without your knowledge. This information may be used by suspicious third-parties. This wikiHow article teaches you how to find and remove hidden spy apps on your Android device.

Method 1

Method 1 of 3:

Checking the Signs of Spyware

1
Check if your phone's battery starts draining rapidly. It is to be expected that your battery life will gradually degrade over time. Older devices aren't going to have the same battery life they once had, but if you notice your battery life is quickly draining all of a sudden, this could be a sign that you have spyware or other forms of malware.
2
Check if you are using large amounts of data. Spyware usually collects your personal data and sends it to a hacker or some other entity. This uses data. If you receive a bill with excess data charges or that shows you are using more data than usual, that could be a sign you have spyware. You can use the following steps to check your data usage on your Android device:^{[1]
X
Research source}
- Swipe down from the top of the screen and tap the gear icon to open the Settings menu.
- Tap Connections (Samsung Galaxy) or Network & Internet (stock Android).
- Tap Internet (Stock Android).
- Tap Data Usage (Samsung Galaxy) or tap Settings next to your mobile carrier.
- Check how much data usage you have used this billing cycle.
Advertisement
3
Check if you hear unusual sounds during a call. It could just mean that you have poor reception. However, if you hear unusual clicks, beeps, or distortion during a phone call, it could be a sign that your phone calls are being monitored.
4
Check if your location tracking is in use when it shouldn't be. Whenever an app is using your location tracking, you will see an icon that resembles a map marker/teardrop in the notifications bar at the top. If you see that icon when you are not using any apps that require location tracking, it could be a sign your phone has spyware.
5
Check if you have apps that you didn't install. You can view all the different apps you have installed on your phone in the Settings menu. If you find any apps you didn't install, tap the app the Settings menu and then tap Uninstall to uninstall them immediately. Use the following steps to check what apps you have installed on your phone:
- Swipe down from the top of the screen and tap the gear icon to open the Settings menu.
- Tap Apps or Applications.
6
Check app permissions. Apps usually need to be granted permission to access features and information stored on your phone. You can use the permission manager to check what apps have permission to access different features. If you find any apps that have permissions they are not supposed to have, tap the app and tap Deny to revoke the permission. Use the following steps to check app permissions:
- Swipe down from the top of the screen and tap the gear icon to open the Settings menu.
- Tap Apps or Applications.
- Tap the icon with three dots (⋮) in the upper-right corner.
- Tap Permission manager.
- Tap a feature or service to view apps that have been granted permission.
7
Check if you have any unidentified APK files on your phone. Most spyware and malware has to be sideloaded onto your phone using Android package (.apk) files. Use the following steps to check if you have any unfamiliar APK files or other unrecognized downloads.
- Open the Files or My Files app.
- Tap the Downloads, Apps, or APK.
- Tap App install Files (stock Android only at the top of the Apps folder).
- Check for any files you didn't download.
8
Check your device administrator. Apps that have administrative privileges on your phone or tablet have greater access to your device's system and security features. Some malware and spyware apps may gain administrative privileges without your permission. This allows them to stay hidden and bypass security features. You can check which apps have administrative privileges using the Device Administrator. Use the following steps to check for apps with unauthorized administrative privileges and revoke those privileges:^{[2]
X
Research source}
- Swipe down from the top of the screen and tap the gear icon to open the Settings menu.
- Tap the magnifying glass icon in the upper-right corner.
- Type "Admin in the search bar.
- Tap Device administrators (stock Android) or Device admin apps (Samsung Galaxy).
- Tap an app you don't recognize.
- Tap Deactivate at the bottom.
9
Check if your phone has been rooted. Rooting allows hackers and apps to access system files as well as bypass the security features of your phone. If a hacker gets ahold of your phone or tablet, they may root your device before installing spyware. If your phone has been rooted and you didn't do it, there's a good chance spyware or malware has been installed on your phone. You can check your root status using apps like Root Checker, which is free from the Google Play Store.

Method 2

Method 2 of 3:

Scanning for Spyware

1
Open the Google Play Store
. It has an icon that resembles a colorful 'play' triangle. Tap the Google Play Store icon to open the Google Play Store.
2
Tap your profile icon. It's the image in the upper-right corner. This displays your profile menu. If you have not selected a profile image for your Google account, it will display a colored circle with your initial instead.
3
Tap Play Protect. It's about halfway down the Google account menu. Play Protect is Google's free antivirus scanner that comes preinstalled on all devices.
4
Tap Scan. It's in the center of the screen. This scans all apps installed on your device (including apps not from the Google Play Store) for malware.
5
Follow the instructions to remove any detected malware. If any malware is detected, it will display instructions on how to remove the app. You may be able to tap a button to delete the malware apps, or it may give you instructions on how to remove administrative privileges for the detect malware apps.
6
Install a third-party antivirus app. Play Protect may not be able to detect all malware and spyware on your device. If you want protection beyond Play Protect, you can download a third-party antivirus app from the Google Play Store. Enter the name of a reputable third-party antivirus app in the search bar at the top of the Google Play Store to search for the app. Tap the app and then tap Install to install it.
- Third-party antivirus apps include Malwarebytes, Malwarefox, Incognito - Spyware Detector, Kaspersky Mobile Antivirus, and Avast Mobile Security.
7
Open your Antivirus app. Tap the app icon for your Antivirus application on your Home screen or Apps menu to open your antivirus app.
- The first time you open the antivirus app, you may be required to sign up for an account. Most antivirus apps have a paid subscription services. However, most of them also offer a free subscription tier or a free trial you can use to scan for spyware on your Android device.
8
Tap the option to perform an antivirus scan. Each antivirus app has a different menu layout, but the option to perform a scan is usually a large button in the center of the screen.
9
Follow the instruction to remove any detected malware. If spyware or malware is detected on your phone, it will display what was found and give you instructions on how to remove it. Follow the instructions to remove any malware that was detected on your phone.

Method 3

Method 3 of 3:

Uninstalling Spyware Apps in Safe Mode

1
Boot your Android device into safe mode. If you find spyware that is particularly hard to uninstall, you can try uninstalling it in safe mode. Use the following steps to boot your phone into safe mode.
- Press and hold the power button until you see the Power options screen.
- Press and hold the Power off button until you see the safe mode option appear.
- Tap Safe Mode.
- Wait until your phone reboots.
2
Open the Settings menu
. To do so, tap the Settings menu icon in the Apps menu, or swipe down from the top of the screen and tap the gear icon in the upper-right corner.
3
Open the device administrators menu. This is in a different location depending on if you are using a Samsung Galaxy or a stock Android device. Use one of the following steps to open the device administrators menu.
- Stock Android: Tap Security & privacy on the Settings menu. Then scroll down and tap More Settings. Tap Device Administrators.
- Samsung Galaxy: Tap Apps in the Settings menu. Then tap the icon with three dots (⋮) in the upper-right corner. Tap Special Access in the drop-down menu. Then tap Device admin apps.
4
Deactivate any apps that have administrative privileges that aren't supposed to. Look through the list of apps that have administrative privileges. If you see any that didn't come preinstalled on your phone or aren't supposed to have administrative privileges, tap the app. Then tap Deactivate at the bottom of the screen.
5
Return to the main menu of the settings app. To do so, tap the arrow pointing left in the upper-left corner to return to the previous menu. Keep pressing the back arrow until you return to the main root menu of the Settings menu.
6
Tap Applications or Apps. It's on the main menu of the Settings app. This displays a list of all installed apps.
7
Locate any suspicious apps. Look through the list of apps installed on your phone or tablet. Locate any apps you don't recognize or didn't install.
8
Uninstall any suspicious apps. To do so, tap any app you want to uninstall. Then tap 'Uninstall' at the bottom of the screen.