Protect Yourself From Stalkerware, Doxing, and Spyware

If you suspect a partner, ex, roommate, or acquaintance is using hacking tools to spy on you, dox you, or share your images without consent, act in this order: preserve evidence, use a safer device to seek help, lock down your accounts, and only then consider removing malware or changing devices. Do not alert the person or wipe your phone until you have a safety plan—removal can escalate abuse or destroy valuable evidence.

In practical terms, that means: take photos or recordings of abusive messages and suspicious apps; switch to a device they’ve never touched (a friend’s phone or a library computer) to reset important passwords; turn on two-factor authentication with a new email and phone number; and talk to a trained advocate before you try to clean your devices. This guide walks you through every step, with recommended tools, trade-offs, and when to involve platforms or law enforcement.

What changed—and why it matters now

Consumer-grade hacking kits once aimed at IT hobbyists or parents are now openly traded in chat groups and online marketplaces. Many are marketed as “monitoring” or “family safety” software but can be installed covertly to capture texts, photos, locations, and account logins. Encrypted messaging channels also facilitate the distribution of nonconsensual intimate images and doxing. The barrier to entry has dropped: people without technical backgrounds can cause serious harm in minutes.

The result is a wave of intimate partner surveillance, image-based abuse, and coordinated harassment. This guide focuses on defense: how to recognize risk, harden your accounts and devices, safely collect evidence, and get images removed.

Who this is for

• Survivors of intimate partner abuse, stalking, or harassment
• People receiving threats, blackmail, or nonconsensual image sharing
• Anyone noticing unexplained knowledge of their whereabouts or communications
• Parents or caregivers managing shared devices who want to avoid misuse
• HR, security, and IT responders advising at-risk employees

Key takeaways (quick version)

• Don’t tip off the abuser. Plan from a safe device first.
• Prioritize account takeover prevention: email, cloud storage, social, banking.
• Preserve evidence before you clean a device.
• iPhones are harder to compromise without physical access, but settings and account sharing can still leak data. Android devices are more often targeted by stalkerware apps.
• Use hardware keys or app-based two-factor authentication, not SMS, where possible.
• Seek platform takedowns for images and reports for doxing; consider legal options with an advocate.

Immediate safety steps (first 24–48 hours)

1. Use a safer device

• Assume your primary phone may be monitored. Use a different device they’ve never accessed for research, password changes, and contacting support services.

2. Preserve evidence

• Screenshot or screen-record abusive messages, suspicious app lists, and settings pages showing device admin permissions or profiles. Photograph physical trackers.
• Note dates, times, usernames, phone numbers, and URLs. Save files to an external drive or a new cloud account.
• Avoid sharing originals over chat; store copies securely. An advocate or lawyer can advise on chain-of-custody if needed.

3. Risk assessment and safety plan

• If you fear violence, contact a local domestic violence hotline or advocacy organization to plan safely before changing routines or removing software.

4. Lock down the accounts they likely target first

• Primary email(s), Apple ID/Google account, mobile carrier, password manager, social media, and financial accounts.

5. Decide on device strategy

• Option A: Clean slate with a new device and new accounts (safest, costlier).
• Option B: Carefully remove stalkerware after planning (risk of escalation).
• Option C: Maintain a “compromised” device for low-stakes use while migrating life to a new safe device (sometimes safest in high-risk cases).

Signs you may be targeted

• They know where you’ve been without you telling them, or show up unexpectedly.
• You notice faster battery drain, high data usage, or the phone runs hot while idle.
• Unknown apps with generic or “system” names; apps with Device Admin/Accessibility permissions you didn’t grant.
• Unexplained prompts for Apple ID/Google logins, password reset emails you didn’t request.
• Smart home devices (cameras, doorbells, speakers) move, change settings, or behave oddly.
• Social accounts post or message without your knowledge.

Note: Sophisticated attackers can hide well. Absence of obvious signs doesn’t mean you’re safe—prioritize account security regardless.

Account lockdown: where to start and what to buy

1. Email and cloud accounts

• Change passwords from a safe device using a strong, unique passphrase (preferably via a password manager).
• Add two-factor authentication (2FA) with an authenticator app or a hardware key. Avoid SMS 2FA if the abuser might access your texts or carrier account.
• Review recovery options: replace old phone numbers and secondary emails.
• Audit connected devices and sessions; sign out of all others.

2. Password manager

• Use a reputable manager to create and store unique passwords for all accounts. Turn on 2FA for the manager itself.

3. Hardware security keys (recommended buy)

• YubiKey, Feitian, or Google Titan keys provide phishing-resistant 2FA. Keep a primary and a backup key stored separately.

4. Mobile carrier protections

• Add or change your account PIN and security questions.
• Ask your carrier to enable SIM swap/port-out locks and number transfer protections.

5. Social media, banking, and storage

• Rotate passwords. Turn on 2FA. Remove unknown connected apps. Check login history and active sessions. Consider privacy mode for friend lists and posts.

Device checks and cleanup (with safety caveats)

Only proceed after evidence is preserved and you’ve considered safety risks.

iPhone/iPad (iOS/iPadOS)

• Software updates: Install the latest iOS.
• Apple ID security: Settings > [Your Name] > Password & Security > Sign-In & Security. Review devices, remove unknown ones.
• Sharing audit: Settings > Privacy & Security > Safety Check. Use Emergency Reset or Manage Sharing to revoke access to location, photos, calendars, Home, and shared Apple IDs.
• Profiles: Settings > General > VPN & Device Management. Remove unknown profiles or MDM; note removal can alert whoever installed it.
• Location: Settings > Privacy & Security > Location Services. Audit app access; disable sharing in Find My for anyone unsafe.
• Backups: Consider setting up a fresh Apple ID on a new device if your old one is deeply entangled.

Limitations: iOS rarely allows true “stalkerware” apps without jailbreaking, but shared Apple IDs, iCloud Photo Sharing, Family Sharing, and abusive access to backups can still leak data.

Android phones/tablets

• Software updates: Apply all updates.
• App inventory: Settings > Apps > See all. Look for unfamiliar or generic names, especially with Accessibility Service enabled.
• Device admin: Settings > Security > Device admin apps (or Device admin). Revoke unknown entries.
• Accessibility: Settings > Accessibility > Installed services. Turn off anything you don’t recognize.
• Unknown sources: Ensure Install unknown apps is off for all but trusted stores.
• Google account: myaccount.google.com > Security. Review devices, 2FA, and app access.

Limitations: Some stalkerware disguises itself. If in doubt, back up essentials and consider a factory reset or a new device with a new Google account.

Windows and Mac computers

• Update OS and browsers; enable automatic updates.
• Create a new administrator account for yourself; demote or remove others you don’t trust.
• Check login items/startup apps; uninstall remote access tools you didn’t install (e.g., unauthorized TeamViewer, AnyDesk, Chrome Remote Desktop).
• Review browsers for suspicious extensions; reset sync and clear unknown devices from account pages.

Network and smart home

• Router: Change the admin password; update firmware; disable remote administration unless required. Create separate Wi‑Fi networks for personal devices and smart home gadgets.
• Cameras and smart speakers: Audit account owners and shared users; rotate passwords; consider factory resetting and re‑provisioning with a new account.
• Car and trackers: Watch for unknown Bluetooth trackers; iOS and Android now provide cross‑platform alerts for unwanted tracking. If you get repeated alerts with no visible device, involve law enforcement.

Anti-stalkerware tools: what works and what to expect

No tool is perfect. Use them to inform your plan—not as your only line of defense.

• Malwarebytes Mobile Security (Android/iOS)

  • Pros: Member of the Coalition Against Stalkerware; flags many monitoring apps; good general malware protection.
  • Cons: Can’t see everything; removal may alert the abuser; iOS scans are hygiene-focused due to platform limits.

• Certo (iPhone via computer, Android app)

  • Pros: iPhone scans via backup analysis can flag jailbreak remnants, risky configurations, or signs of compromise; Android app detects known stalkerware.
  • Cons: Requires a computer; can’t find unknown or custom tools; results are indicators, not proof.

• ESET/Bitdefender/Lookout/Norton (Android/iOS)

  • Pros: Solid mobile security suites; detect many known stalkerware families.
  • Cons: Coverage varies; iOS limitations apply.

• TinyCheck (network-level, advanced)

  • Pros: Open-source tool that inspects a device’s network traffic via a separate Wi‑Fi access point to spot suspicious connections.
  • Cons: Technical to set up (often on a Raspberry Pi); best used by a technician or advocate.

Bottom line: If a scan flags something, preserve evidence and get advice. If scans find nothing but you still see behavioral red flags, proceed with account lockdown and consider a clean device migration.

Removing nonconsensual images and responding to doxing

• Takedowns for adults: Use a hash-based service that helps you create a digital fingerprint of your intimate images and request removals from participating platforms.
• Takedowns for minors: The “Take It Down” program (run by a national child protection center) accepts images of minors to help remove them from participating sites.
• Platform reports: Report within each app/site using their abuse tools. Choose categories like Nonconsensual Intimate Image, Sexual Exploitation, Harassment, or Doxing. Keep copies of the reports and responses.
• Search engines: Submit removal requests for doxing content that reveals highly sensitive information (IDs, bank numbers) where applicable.
• Evidence: Save original image files/URLs, account names, and time-stamped posts. Do not engage with harassers.

If there’s credible threat of violence, extortion, images of minors, or ongoing stalking, contact law enforcement. Consider working with an advocate or attorney to navigate reporting while protecting your safety.

Legal overview (not legal advice)

• United States: Installing spyware or intercepting communications without consent may violate federal and state laws (computer fraud, wiretapping, stalking). Many states criminalize the distribution of nonconsensual intimate images. Civil remedies and restraining orders may be available.
• United Kingdom: The Computer Misuse Act, harassment laws, and the Voyeurism and Domestic Abuse statutes may apply. Sharing intimate images without consent is a criminal offense.
• European Union: National criminal codes, GDPR, and ePrivacy rules may provide both criminal penalties and civil remedies.
• Australia/Canada: Image-based abuse and unauthorized surveillance are criminalized under federal/provincial/state laws; national safety commissioners or cyber tip lines can help.

Consult a local lawyer or advocacy group to understand options in your jurisdiction and to avoid steps that could endanger you.

Data broker and doxing defense

• Freeze your credit with major bureaus; add fraud alerts where available.
• Remove your data from people-search sites. You can do this manually or via paid services (DeleteMe, Kanary, Incogni, etc.).
• Use separate emails and virtual phone numbers for public accounts.
• Consider a P.O. box or address confidentiality program if you’re at high risk.
• Review public social profiles; lock down friend lists and past posts.

What to buy (defensive kit)

• Two hardware security keys (primary + backup)
• A reputable password manager subscription
• A privacy screen protector for your phone and laptop
• A spare “safe” phone set up with a new account and minimal apps
• USB data blocker (“charge-only”) for public charging
• External drive for secure backups of evidence

What NOT to buy or do

• Don’t purchase “monitoring” or “stalkerware” to “test” or retaliate. It’s likely illegal and escalates harm.
• Don’t confront the abuser about spyware without a safety plan.
• Don’t rely solely on antivirus apps; combine them with account security and behavioral changes.
• Don’t send original evidence through insecure chats; keep primary copies off the compromised device.

When to get help—and from whom

• Domestic violence or stalking advocates: Safety planning, documentation, and legal resources.
• Digital security clinics or nonprofit hotlines: Technical triage, takedowns, and evidence guidance.
• Law enforcement: Imminent threats, extortion, child exploitation, physical trackers, or repeated stalking.
• Civil attorneys: Restraining orders, civil claims, or platform subpoenas.

FAQ

Q: Will a factory reset remove stalkerware?
A: Usually on Android; often unnecessary on iOS unless the device is jailbroken or managed. Back up evidence first and consider setting up a brand-new account afterward.

Q: Can iPhones be compromised without physical access?
A: It’s rare for non-state actors. More common is abuse via shared Apple IDs, iCloud, Find My, or social engineering. Audit sharing and change credentials first.

Q: What if I can’t find any suspicious apps but they still seem to know everything?
A: Focus on account takeover and shared services. Change email/cloud passwords, add 2FA, review who can see your location, and consider a fresh device and number.

Q: Should I hire a hacker or “forensics” service from the internet?
A: Be cautious. Many are scams or could contaminate evidence. Seek referrals from established advocacy groups or licensed professionals.

Q: Are AirTags or other trackers alerting on Android and iPhone now?
A: Yes. Both platforms support cross‑platform unwanted tracker alerts. If alerts persist and you can’t locate the tracker, involve law enforcement.

Q: Will changing my SIM stop them?
A: Not if they control your accounts or device. Secure email and cloud accounts first, add 2FA, then consider a new number with carrier protections.

Q: Could my router be the problem?
A: It’s possible. Change the router admin password, update firmware, and review connected devices. If compromise seems deep, factory reset and reconfigure with a new admin password.

The bottom line

You can’t control what tools abusers buy—but you can control your safety plan. Start with a safer device, lock down your accounts with strong authentication, preserve evidence, and be deliberate about device cleanup. Combine technical steps with advocacy and, when appropriate, legal action. The path to safety is incremental; every account you secure and permission you revoke is a meaningful win.

Source & original reading: https://www.wired.com/story/men-are-buying-hacking-tools-to-use-against-their-wives-and-friends/