Why deleting suspected spyware can put you at greater risk

Suspected spyware demands more than a quick deletion: preserve evidence, use a trusted device and secure accounts only after the risk of monitoring has been assessed.

Spyware and stalkerware are often discussed as if they were the same problem, but the response should depend on who may be behind the intrusion and what the software is doing. The practical first step is not to rush into deletion. If there is any chance that an abusive partner, ex-partner or other person with physical access is monitoring a phone or computer, the safer course is to switch to a trusted device, preserve evidence and avoid making changes on the suspect device until a plan is in place. Guides from TechTarget and TechJournal both stress that battery drain, overheating, crashes and unfamiliar apps can be warning signs, but no single symptom proves compromise.

That distinction matters because ordinary malware and stalkerware require different priorities. In a conventional infection, the focus is containment, scanning and account recovery. When stalking or coercive control is possible, personal safety comes first, followed by evidence preservation and a controlled reset or replacement if needed. The FTC has previously described spyware as software installed without the owner’s knowledge that can capture location, messages, photos, videos, keystrokes and other activity, while Google defines malware more broadly as harmful software installed without permission.

On phones, the clearest warning signs are often indirect: faster battery drain, unexpected mobile-data usage, unexplained heat, repeated restarts and apps that the owner does not remember installing. A familiar app may also request unusually broad access to the microphone, camera, location, contacts, messages or accessibility features. Security guides from TechJournal, 2-Spyware and McAfee all point to the same pattern: spyware commonly tries to blend in with legitimate software, so the clue is often behaviour rather than appearance.

On Windows PCs, Macs and web browsers, the signs are similar but easier to misread. Persistent pop-ups, redirects, altered search settings, suspicious toolbars or browser extensions, unexplained slowness and security tools being disabled are all reasons to investigate. Google’s own malware guidance also treats unexpected sign-outs, unwanted extensions, changed search preferences and repeated redirects as indicators worth checking. Because legitimate updates, poor connectivity and ageing hardware can create similar symptoms, the safest approach is to review the device methodically rather than assuming every problem is malicious.

The removal process should begin with updating the operating system and security tools, then reviewing installed apps, extensions and permissions. TechTarget recommends a layered approach on mobile devices, including identifying suspicious software, removing it where possible and applying current patches. On Android, that means checking recent apps, revoking device-administrator or accessibility control where appropriate, and reviewing permissions for location, microphone, camera, messages and notifications. On iPhone and iPad, it means checking for unfamiliar apps, account access, device-management settings and sharing permissions, then following Apple’s tracker alerts if an unknown AirTag or Bluetooth tracker is involved.

If the software returns, or if there is no reliable way to tell what has been altered, a reset may be necessary. The advice from security specialists is consistent: back up only trusted personal files, not the whole device image, because restoring a complete backup can reinstall the same unwanted software. For phones, the Internet Crime Complaint Center has said a factory reset is the only dependable way to remove certain mobile spyware permanently. For computers, a clean reinstall may be needed if browser extensions, policies or hidden components keep reappearing after normal cleanup.

Even after a device is cleaned or reset, account security remains a separate task. Password changes should be made from a trusted device, starting with email, because email access often controls resets for every other service. Security experts also advise reviewing recovery numbers and addresses, active sessions, forwarding rules, trusted devices and app passwords, then enabling two-factor authentication. A reset removes local software, but it does not automatically revoke access to cloud accounts, shared location settings or compromised recovery methods.

The most important mistake is treating spyware as a simple technical nuisance when there may also be a safety issue. Deleting suspicious software too quickly can erase evidence and alert the person responsible. Changing passwords on a monitored device can expose the new credentials. Restoring everything from a backup can undo the cleanup. The most reliable path is a careful sequence: use a trusted device, assess the risk, preserve evidence if needed, clean or reset the device, then secure accounts and recovery settings before returning to normal use.