Spyware, stalkerware, and remote access trojans run constantly in the background, silently collecting your data, transmitting it to a remote server, and activating your camera or microphone. All of this activity burns through battery power at a rate far beyond what your normal apps consume.

If your phone used to last all day and now dies by early afternoon — without any change in your usage habits — something is running behind the scenes that you have not authorized.

• Check Battery Usage: Go to Settings → Battery → Battery Usage. Look for any app consuming an unusually high percentage that you do not recognize or have not recently used.
• Check Screen-Off Consumption: High battery drain while the screen is off (not in standby) is a particularly strong indicator of background malicious activity.
• Compare to baseline: If battery health is good (above 80%) but drain is severe, a rogue process is the most likely explanation.

Spyware needs to send its harvested data somewhere. That means your phone’s internet connection — your mobile data plan — is being used without your knowledge to transmit your messages, contacts, photos, location, and call logs to a remote hacker-controlled server.

This shows up as a mysterious spike in your monthly data usage, especially if the spike occurs in apps you barely use or in unfamiliar background processes.

• Android: Settings → Network & Internet → Data Usage → App data usage. Sort by highest usage and look for anything suspicious.
• iPhone: Settings → Mobile Data / Cellular → scroll down to see per-app data consumption. Reset statistics monthly for accurate tracking.
• Look for background data: An app using more data in the background than in the foreground is a major warning sign.

Finding an app on your phone that you have no memory of installing is one of the clearest signs of a compromise. Hackers install spyware, remote access tools, and keyloggers through malicious links or through other compromised apps that silently download additional malware.

On Android especially, malicious apps can be installed without your knowledge if you have ever enabled « Install from Unknown Sources » — even briefly — or if a malicious app exploits an operating system vulnerability.

• Review all installed apps: Go through your complete app list carefully. Malicious apps often use generic, non-suspicious names like « System Service, » « Phone Manager, » or « Battery Optimizer. »
• Check install dates: On Android, go to the Play Store → Manage Apps to see when each app was installed. An install date that coincides with when your phone started acting strange is highly suspicious.
• Look for apps without icons: Some stalkerware hides its icon from the home screen but remains active. Check the full app list in Settings, not just your home screen.

A phone that runs warm while gaming or streaming video is normal. A phone that becomes uncomfortably hot while sitting untouched on your desk — screen off, no active apps — is not. Malware and spyware demand significant processing power to run, and that processing generates heat.

If your phone feels warm or hot to the touch regularly while idle, something is actively running that you have not permitted. This is especially suspicious when combined with battery drain.

• Touch test: A phone that is hot enough to be uncomfortable when you have not used it in 20+ minutes warrants investigation.
• Check active processes: On Android, Developer Options shows running processes. On iPhone, a sudden reboot or crash alongside overheating can signal a background exploit.
• Rule out hardware issues: A failing battery can also cause overheating — check if your battery is swollen or if the back of the phone bulges slightly.

If your contacts are receiving strange messages from your number — or if your call log shows calls to numbers you do not recognize — your phone or your SIM card may be compromised. This is one of the most serious and concrete signs of a hack.

Hackers use compromised phones to send spam or phishing messages to your entire contact list. They may also use your number for SMS verification to create fraudulent accounts in your name, or to spread malware to your friends and family.

• Review your call log in full: Look for calls at odd hours, especially late at night, and calls to international or premium-rate numbers you would never dial.
• Check your sent messages: In your SMS app and any messaging apps (WhatsApp, Telegram, iMessage), look for sent messages you do not remember sending.
• Ask your contacts: If a friend says they received a weird link or message from you that you did not send, treat this as confirmed compromise.

While a slow phone can simply mean it needs a restart or a storage cleanup, a sudden and unexplained drop in performance — especially when combined with other signs on this list — can indicate malware consuming your phone’s CPU and RAM resources in the background.

You might notice apps taking much longer to load, the phone becoming unresponsive during normal use, apps crashing randomly, or the screen flickering briefly when you are not touching it. That last one — screen activity when idle — is particularly alarming and can indicate remote access.

• Screen activity while idle: If your phone screen briefly lights up, letters appear, or apps open without you touching the phone, this strongly suggests remote access malware.
• Random reboots: Frequent, unexplained reboots can indicate an operating system being exploited or a malware process causing crashes.
• Settings changes you did not make: If your Wi-Fi, Bluetooth, or permissions settings change on their own, treat this as a critical red flag.

This is perhaps the most alarming sign of all. If your camera or microphone is being accessed by spyware, the hacker can see and hear everything happening near your phone in real time. You may notice the camera indicator light on iPhones appearing unexpectedly, or Android’s privacy indicators (the small dot that appears when camera or mic is in use) activating when you are not on a call or using any camera app.

Sophisticated spyware like Pegasus has been documented accessing cameras and microphones without triggering any visible indicators — but most commercial stalkerware is not that advanced and will leave traces.

• iOS indicator: The orange dot (microphone) and green dot (camera) in the top-right corner of your screen appear whenever these hardware components are accessed. Check the Control Center for a recent app history of which app accessed them last.
• Android privacy dashboard: On Android 12+, go to Settings → Privacy → Privacy Dashboard to see a timeline of all camera, microphone, and location access by app.
• Check permissions: Go through every app that has camera or microphone permission. Revoke access for any app that does not have a legitimate reason to need it.