What Is Spyware? How It Works, Types & How to Remove It

Spyware is a category of malware that secretly monitors a user's activity and collects information without their knowledge or consent — then sends it to an attacker. The data it harvests can include keystrokes, passwords, browsing history, screenshots, messages, location, and financial details. Spyware's goal isn't to damage your system; it's to watch it. The most effective spyware is the kind you never notice, quietly siphoning information for weeks or months.

In short: spyware is digital surveillance turned into malware. Where ransomware screams for attention, spyware does the opposite — its whole value depends on staying invisible.

How spyware works

Once installed, spyware embeds itself on a device and begins collecting data through one or more techniques: logging keystrokes, capturing screenshots, reading files and saved credentials, tracking web activity, or intercepting messages and calls. It then quietly transmits this data back to the attacker — activity that often shows up as unusual outbound traffic, a classic indicator of compromise. Good spyware is engineered to use minimal resources and avoid obvious symptoms so it can keep watching for as long as possible.

How spyware gets onto a device

• Bundled with other software — hidden inside free programs, "cracked" applications, or browser extensions.
• Trojan delivery — disguised as legitimate software via a trojan.
• Phishing — malicious links and attachments from phishing messages.
• Malicious or fake apps, especially from unofficial mobile app stores.
• Exploiting vulnerabilities — advanced mobile spyware can sometimes install with little or no user interaction by exploiting zero-day flaws.

Types of spyware

• Keyloggers: record every keystroke to capture passwords, messages, and card numbers.
• Infostealers: a booming subcategory that grabs saved passwords, browser cookies, and crypto wallets, then sells them in bulk — covered in depth in our guide to infostealer malware.
• Adware and tracking software: monitors browsing to serve targeted ads; intrusive but usually less harmful than data-stealing spyware.
• Stalkerware: commercial "monitoring" apps installed by someone with physical access — often in the context of domestic abuse — to track another person's location, messages, and calls.
• Banking / financial spyware: specifically targets online banking sessions and payment credentials.
• Mobile / mercenary spyware: highly advanced surveillance tools (the most notorious being commercial spyware like Pegasus) used to target journalists, activists, and officials, capable of accessing nearly everything on a phone.

Signs of a spyware infection

• Faster-than-normal battery drain, overheating, or sluggish performance.
• Unexpected spikes in data usage or outbound network traffic.
• New toolbars, extensions, icons, or apps you didn't install.
• Browser settings or your homepage changing on their own; frequent redirects.
• Accounts showing logins from unfamiliar locations, suggesting stolen credentials.

As with other stealthy malware, the most capable spyware may produce no symptoms at all — which is why monitoring and behavior-based detection matter more than waiting to spot something.

How to remove spyware

1. Disconnect from the internet to stop it transmitting data.
2. Run a reputable anti-malware tool to scan for and remove known spyware.
3. Update your operating system and apps to close the vulnerabilities it may have used.
4. Change your passwords from a different, clean device — and enable multi-factor authentication. Anything typed on the infected device should be considered compromised.
5. For stalkerware or advanced mobile spyware, a full factory reset (and seeking help, if it's a safety situation) is often the safest course.

How to defend against spyware

• Install software and apps only from trusted, official sources.
• Be cautious with email attachments, links, and browser extensions.
• Keep your operating system and applications patched as part of good vulnerability management.
• Use behavior-based endpoint protection that detects spying behavior, not just known signatures.
• Use unique passwords and phishing-resistant multi-factor authentication so stolen credentials are less useful.

Mobile spyware: a growing threat

Spyware is no longer just a desktop problem — phones have become a primary target, and for good reason. A modern smartphone holds your messages, location, photos, microphone, camera, banking apps, and the second factor for nearly every account you own. Mobile spyware ranges from commercial "stalkerware" apps marketed as parental or employee monitoring, to highly advanced mercenary spyware capable of compromising a device through a single malicious link or even a "zero-click" exploit that needs no interaction at all. Warning signs on mobile mirror those on desktop: unusual battery drain, overheating, unexpected data usage, and unfamiliar apps or profiles. Because mobile spyware can be deeply embedded, a factory reset is often the most reliable removal step, and keeping the operating system fully updated closes many of the vulnerabilities such spyware relies on.

Is all spyware illegal? Grayware and consent

Not every program that collects data is outright malware. A large gray area — sometimes called grayware — sits between clearly malicious spyware and legitimate software. Aggressive adware, overreaching "free" apps, and tracking libraries may technically disclose their data collection in a buried terms-of-service agreement, making them legal but unwanted. Commercial stalkerware occupies an especially troubling middle ground: it's often sold as legal monitoring software, yet installing it on another adult's device without consent is illegal in many places and is a recognized tool of abuse. The practical test for most users is consent and transparency: software that collects your data secretly, or that someone installs on your device without your knowledge, is spyware regardless of how its makers describe it.

Where threat intelligence fits

Spyware — especially infostealers and mercenary mobile spyware — is a major driver of credential theft and follow-on breaches. Threat intelligence tracks active spyware families, the infrastructure they report to, and the stolen data that surfaces through dark web monitoring. This early warning helps organizations spot compromised credentials before attackers use them to break in.

The bottom line

Spyware is malware built for surveillance — it quietly monitors activity and steals data, from keystrokes and passwords to location and messages, while trying to stay invisible. Its forms range from keyloggers and infostealers to stalkerware and advanced mercenary mobile spyware. Defense combines trusted-source habits, patching, behavior-based detection, and strong authentication, while removal often requires a clean scan, password resets from another device, or a full reset. To track the credential-stealing threats active right now, follow our live threat intelligence feed, aggregated from dozens of authoritative sources.