Is your phone truly private or does unwanted software run out of sight?

Recent data shows 18.1% of mobile devices had malware in 2025. That risk changes how professionals handle a work phone and personal device.

Modern phones show a green or orange dot when the camera or microphone turns on. Still, stalkerware and remote access trojans can trigger sensors while running hidden tasks.

This introduction outlines clear, fast checks for signs of intrusion. You get steps to verify phone camera and microphone usage, review apps and permissions, and spot odd performance or ghost photos.

Follow simple setting checks and removal order to isolate a compromised device, secure accounts, and restore security. The guidance balances data-driven facts with practical actions for marketers and tech teams.

Key Takeaways

• Learn quick red flags for phone compromise and unusual usage.
• Verify which app accesses the phone camera or microphone via settings.
• Spot spyware signs: unfamiliar apps, ghost photos, and slow performance.
• Use a stepwise removal plan to isolate the device and protect accounts.
• Harden security with permission hygiene, safe downloads, and app 2FA.

Why this how-to guide matters right now

Today’s device risks are urgent—malware and spyware move fast and silent. Zimperium’s 2025 research shows 18.1% of devices carry malware. That means a single phone can leak corporate data, harvest 2FA codes, and access banking or email apps.

Attackers exploit predictable paths: phishing links, sideloaded apps from third‑party stores, compromised public Wi‑Fi, and SIM swap scams. These vectors let intruders intercept calls and texts or push malicious features that run without notice.

Mobile devices now hold more sensitive information than many laptops. Rapid detection matters for business continuity. Treat odd screen behavior, unexpected activity spikes, and unexplained usage as serious signs—not random glitches.

Practical focus: reduce exposure by hardening accounts, enforcing app‑based 2FA, and using a password manager. Audit permissions, tighten defaults, and review location and sensor access across apps to preserve performance and trust across teams.

• Prioritize phishing defense and avoid unsafe Wi‑Fi.
• Limit sideloading and rely on vetted app stores.
• Check call forwarding and monitor for SIM swap signs.

For a concise checklist and next steps to verify a compromised phone, follow this guide: check who may have accessed your.

Quick signs your device may be compromised

Unexpected sensor activity on a phone often signals hidden processes running in the background. Small lights, odd screen wakeups, or phantom files deserve immediate attention.

Indicator lights that turn on unexpectedly

Watch the green or orange dot. If the indicator light for the camera or microphone lights when you are not recording, treat it as a red sign. This can point to spyware running the phone camera or mic without permission.

Sudden spikes in cellular data and background activity

High cellular data or strange data usage often means background transfers to external servers. Check per-app usage to find unknown culprits. Unfamiliar installs and system-wide pop‑ups also suggest adware or malware.

Overheating, rapid battery drain, and sluggish performance

Overheating, quick battery loss, and slow performance are classic signs of spyware. Look for ghost photos, new files, and delayed app launches. If calls or texts stop, consider SIM swap or call forwarding and contact your carrier fast.

• Check indicator behavior, then cross-check data and battery per app.
• Scan for unknown apps and system-wide ads.
• If multiple signs appear, isolate the device and follow removal steps immediately.

How to check data usage and background activity

Compare per‑app data and battery views to spot suspicious transfers. Short checks in settings help reveal apps that push data or run hidden services. Follow the steps below to find unusual activity fast.

On iPhone: audit cellular and battery

Open Settings > Cellular to view per‑app cellular data. Disable cellular data for nonessential apps to stop leaks.

Then go to Settings > Battery and check Battery Usage by App. Look for sudden spikes or apps active while the screen is off.

Temporarily turn off Background App Refresh to test whether hidden background transfers caused the issue.

On Android: review app data, services, and battery

Open Settings > Network & Internet > SIMs > App data usage to find apps with high transfers. Enable Developer Options and check Running services to stop unfamiliar processes.

Use Settings > Battery > Battery usage to compare power draw against data totals. Then open the app drawer and Settings > Apps > See all apps to check apps that hide as system utilities.

• Note overnight spikes—scheduled transfers can indicate malware or automated exfiltration.
• Document screenshots and totals before removal; that helps IT or your carrier.
• If usage drops after restricting an app, uninstall it and run a full review.

How to tell if someone is watching you through your phone camera

Unexpected camera behavior often signals an app running sensors in the background. Start with quick checks that take minutes but give clear clues.

Investigate camera behavior

Open the camera and scan recent albums for ghost photos or videos. Note timestamps and repeat patterns that match odd activity.

If a third‑party app launches on its own or the camera app crashes often, treat that as a high‑risk sign. Test local video recording for glitches; poor quality can indicate spyware interference.

Audit camera permissions and revoke access

Go to Settings > Privacy > Camera. Revoke permissions for apps that don’t need the camera. Review browser site permissions and remove unknown entries.

Watch the indicator and verify the active app

Check the green or orange indicator light and pull down Control Center or quick settings. The on‑screen banner will show which app uses the camera or microphone in real time.

Sign	What it means	Immediate action
Ghost photos/videos	Possible remote capture or synced media leak	Document timestamps; uninstall suspicious apps
App opens alone / crashes	Background process or faulty app	Force stop app; revoke permissions; run scans
Indicator on, no active use	Sensor access without consent	Pull up active app info; isolate device if needed

Call and audio red flags that point to spyware

Unusual audio during a phone call often signals unauthorized access to the microphone or call services. Listen for repeating artifacts and act fast.

Static, clicking, echoes, or shutter sounds during calls

Consistent static, clicking, echoes, or shutter noises on active calls can mean a background process is tapping audio. Treat recurring sounds as a red flag rather than a one-off glitch.

Run quick tests with a trusted contact. If the same issues happen across cellular and Wi‑Fi, the problem likely sits on the phone or in a local app.

Use carrier and USSD checks (*#21#, *#62#) for call forwarding

Dial *#21# to check unconditional forwarding and *#62# to see where calls go when unreachable. Screenshot results for evidence.

• Contact the carrier immediately if unknown numbers appear and remove unfamiliar forwarding rules.
• Ask the carrier to add a port‑out or SIM swap protection PIN to block number hijacking.
• Disconnect Wi‑Fi and cellular if interception is suspected, then isolate the device and secure accounts.
• Document call and message logs; this helps IT and support teams handle potential malware or spyware incidents.

After cleanup: enforce app‑based 2FA and review call settings. For broader device security guidance, see make your laptop secure. If odd sounds persist, escalate to your carrier and IT—this may indicate targeted tampering by malicious actors.

Files, storage, and app anomalies that signal surveillance

Hidden media and sudden storage alerts can signal active surveillance on a phone.

Suspicious files and odd storage behavior often appear before other symptoms. Malware can hide large media to avoid immediate upload. Pegasus and similar threats show how zero‑click exploits can create secret folders.

Mystery photos, low storage, and large hidden files

Scan albums for mystery photos or videos. Check creation times and file sizes for repeats.

If you see low storage warnings with light usage, search for big hidden files tied to unknown apps.

Unfamiliar apps, Bluetooth activity, and pop‑ups

Audit installed apps and sort by last used. Remove apps you do not recognize.

Watch for unexpected Bluetooth pairing and system‑wide pop‑ups; treat them as adware or worse.

• Correlate storage drops with data usage spikes—surveillance often saves captures locally before transfer.
• Review app permissions and revoke access that exceeds an app’s purpose.
• Treat random reboots, phantom touches, or brightness shifts as a serious sign.

If anomalies persist, prepare a clean offline backup and factory reset. Escalate to IT or a technician when persistence suggests advanced spyware or a zero‑click exploit.

Step-by-step: Remove hackers and malware from your phone

Begin by cutting network access to stop active data exfiltration from the phone. This prevents remote services from sending more data or triggering camera features.

Isolate the device

Turn on Airplane Mode and disable Wi‑Fi and Bluetooth. If Airplane Mode won’t hold, remove the SIM or power the device down.

Secure critical accounts from a safe device

From a separate, trusted device reset passwords for email, banking, Apple ID or Google account, and social accounts. Enable app‑based 2FA and revoke unknown sessions.

Use the removal checklist for detailed account steps.

Scan and remove

On Android, install a reputable antivirus, run a full scan, and quarantine threats. On iOS, perform a manual app review and revoke excessive permissions.

Uninstall suspicious apps and clear browser cache and downloads. Review camera, microphone, location, contacts, and SMS access for excess rights.

Safe Mode, backup, and factory reset

Boot Android into Safe Mode to remove stubborn apps; if issues stop there, a malicious app likely caused the activity. If compromise persists, back up only essential files to a clean location then factory reset.

After cleanup, re‑enable network connections and monitor device activity and data usage for 48–72 hours.

Situation	Action	Why
Odd camera/mic activity	Isolate + revoke permissions	Stops ongoing access
Persistent background services	Safe Mode scan or antivirus	Helps identify and remove apps
Unresolved compromise	Clean backup + factory reset	Restores device integrity

Privacy settings to stop stalkerware from accessing your camera and mic

Begin with a permissions audit. Review camera and microphone rights in Settings and revoke anything unnecessary. Limit apps that can run in the background to reduce silent sensor polling.

Permission hygiene: Camera, microphone, and background access

Strip camera and microphone access from apps that do not need them. Disable background access for casual apps; that lowers data transfer and hidden activity.

Location privacy: Limit “While Using,” remove photo metadata, and restrict services

Set location to While Using for most apps and deny Always unless essential. Remove location metadata from photos before sharing to prevent revealing home or office coordinates.

Safe downloads and updates: Avoid jailbreaking/rooting; stick to official stores

Do not jailbreak or root a device. Install apps only from official stores and keep the OS and apps updated to close known exploits spyware may use.

• Audit permissions quarterly and adopt a deny‑first default.
• Watch the sensor indicator light; open the active app panel to block any suspicious app access.
• Turn off ad tracking and enable lock‑screen privacy to shield sensitive notifications.

For broader prevention steps, review this concise guide on stopping remote intrusion: preventing remote compromise.

Account and network protections that harden your defenses

Locking down accounts and network choices cuts risk faster than reactive scans. Start by treating credentials and connections as the first line of defense for every device and phone. Small policy changes reduce broad exposure across apps and services.

Stronger authentication: Password managers and app‑based 2FA

Use a password manager to store unique, complex passwords and rotate them after incidents. This reduces credential reuse across accounts and apps.

Enable app‑based 2FA (Authy, Google Authenticator, etc.) for critical accounts. Avoid SMS when possible to limit SIM swap and call interception risks.

• Turn on breach alerts in the password manager to catch leaked credentials fast.
• Remove stale sessions and unrecognized devices from Apple ID and Google accounts after an event.
• Enforce device lock with biometrics plus a six‑digit passcode and quick auto‑lock.

Network safety: Secure Wi‑Fi, VPN, and carrier protections against SIM swaps

Prefer private Wi‑Fi and use a reputable VPN on untrusted networks to encrypt data in transit. That limits exposure from malicious routers and phishing redirects.

Ask carriers for port‑out protection and set a SIM PIN. These simple calls stop attackers from transferring your number and taking calls or texts.

• Limit app access to only required permissions and review high‑risk permissions quarterly across phones and devices.
• Use Safe Browsing and ad blocking to reduce phishing redirects and malicious ads.
• Maintain regular backups and document a secure baseline; deviations help you investigate faster.

Protection	Action	Why it helps	When to apply
Password manager	Store unique credentials, enable alerts	Stops reuse and speeds recovery after breaches	Immediately; review quarterly
App‑based 2FA	Use authenticator apps, avoid SMS	Protects accounts from SIM swap and call interception	For all critical accounts
Carrier defenses	Request port‑out protection, set SIM PIN	Binds phone number to account, blocks porting	Once, then verify annually
Network tools	Use VPN, prefer private Wi‑Fi	Encrypts traffic and reduces phishing exposure	On public or untrusted networks

For a concise follow‑up checklist and steps to verify a compromised phone, check who may have accessed your account and device.

are hackers watching you: what to do next

Start by disconnecting the phone from all networks and working from a trusted device.

Cut Wi‑Fi and cellular to stop active data transfers. From a safe device, change passwords and enable app‑based 2FA for critical accounts.

Verify call forwarding with *#21# and *#62#; remove unknown entries and add a carrier port‑out PIN. Audit settings and the indicator light to see which app uses the camera or mic.

Uninstall suspicious apps, run a trusted AV scan on Android, or manually review on iOS. Track data, usage, battery, and storage to confirm remediation.

If symptoms persist, back up essential files only and perform a factory reset from a known‑clean backup. Rebuild security with a password manager, strict permission hygiene for phone camera and location, and team training.

Keep a short list of signs and the fastest way to report a compromised device. Monitor performance and calls for one week to catch recurring indicators.