Spyware is malicious software that installs itself on a device, quietly gathers information — browsing habits, keystrokes, saved passwords, location, screen contents — and sends it back to whoever put it there. Unlike ransomware, it never announces itself: there is no lock screen, no demand, no visible sign. The first symptom is usually a slower device, and the first confirmation is often a compromised account.
TL;DR
- Spyware secretly collects data from your device and sends it to an attacker — passwords, browsing, messages, location.
- It arrives through phishing attachments, bundled free software, malicious browser extensions, and infected websites.
- Modern spyware increasingly targets mobile phones, including commercial stalkerware sold as "parental control" apps.
- Detection relies on baseline awareness: slow devices, unfamiliar processes, battery drain, and unexplained data usage.
- Training that makes "my device is behaving oddly" reportable is the detection layer most businesses are missing.
What is spyware?
Spyware is the surveillance branch of malware. It installs without clear consent, runs hidden, and monetises what it finds — either directly by harvesting banking and email credentials, or by selling the behavioural profile to data brokers and ad-fraud networks. It has been around longer than most other malware classes, and in 2026 it remains one of the most common infections a small business will actually encounter.
Several subtypes matter:
- Info stealers sweep saved browser passwords, cookies, session tokens and crypto wallet files — the most damaging class for businesses, because one infection can expose a whole identity.
- Keyloggers record every keystroke, capturing passwords as they are typed.
- Stalkerware monitors a specific person — messages, location, photos — and is usually installed by someone who knows the device owner.
- Adware hijacks browsing and injects ads; lower stakes, but it confirms the device's defences are failing.
- Banking trojans overlay fake login screens or intercept SMS one-time codes specifically to empty accounts.
How spyware gets onto a device
- Phishing attachments and fake downloads. An invoice, résumé or "security update" that installs the payload — the dominant route in 2026.
- Bundled free software. "Free" PDF converters, media players and cleaner apps that carry spyware in the installer's fine print.
- Malicious browser extensions. Extensions that harvest browsing data and saved passwords — a growing infection path because browsers auto-update extensions silently.
- Compromised or fake websites. Drive-by downloads from sites running outdated software, or lookalike download portals.
- Stalkerware installs. Someone with physical access to a phone installs it while the owner is not looking — a real risk in domestic disputes and on shared devices.
- Mobile app store lookalikes. Fake versions of popular apps that survive in third-party stores and, occasionally, official marketplaces.
What spyware costs a business
The direct damage is stolen credentials. An info stealer on one laptop can expose the corporate mailbox, banking session and password manager in a single sweep — and those stolen sessions circulate on criminal marketplaces for months. The Australian baseline for what follows applies: the Australian Signals Directorate logged more than 84,700 cybercrime reports in 2024-25, one every six minutes, with small business averaging $56,600 per report (ASD Annual Cyber Threat Report 2024-25).
The indirect cost is the long tail: a device may stay infected for weeks, quietly feeding credentials to whoever bought them, until a bank flags a transaction or a colleague notices the strange emails.
Signs of spyware on a device
- Device runs noticeably slower, fans run constantly, battery drains faster than it used to.
- Browser homepage, search engine or extensions changed without anyone's action.
- Pop-ups appearing in places they never did before.
- Mobile data usage climbing with no change in behaviour.
- Contacts receiving messages the owner never sent.
- The phone reboots itself, or shows unfamiliar apps in the installed list.
Any one of these alone proves nothing — old hardware behaves this way too. The pattern across several symptoms, or across several devices in the same week, is what justifies a scan and a credential rotation.
How to detect and remove spyware
- Run a full scan with updated endpoint protection — Windows Defender, Malwarebytes, or your managed endpoint tool.
- Review installed applications and browser extensions, and remove anything nobody remembers installing.
- Check running processes for unfamiliar names consuming CPU or network.
- On mobile: review installed apps, battery usage per app, and device administrator permissions granted.
- After any confirmed infection: rotate every credential used on that device, from a different clean machine, and re-enrol MFA where the device is registered.
- For stalkerware: use a clean device for sensitive communication, and contact a support service before removing it — removal can alert the installer.
How to prevent spyware
- Endpoint protection on every device, with real-time behavioural detection, not just signature scanning.
- Keep operating systems, browsers and apps patched — spyware exploits the same unpatched holes as every other malware class.
- Restrict software installation to admin-approved tools, and treat "free converter" downloads as guilty until proven innocent.
- Allow-list browser extensions and audit them quarterly.
- Disable sideloading on company phones, and install only from official app stores.
- Train staff to report odd behaviour rather than tolerate it — because a slow laptop reported on day one is a contained incident, and the same laptop reported after three weeks is a breach.
Why awareness training is the detection layer
Spyware is designed to be invisible, and technical controls miss freshly built variants. What closes the gap is a workforce that treats a device behaving oddly as something worth telling IT about — not a private frustration to endure. That habit is exactly what structured awareness training builds.
Cyber Aware's security awareness training runs monthly, simulates the phishing that installs spyware, and auto-enrols anyone who clicks into remediation the same day. Human risk reporting then shows, per person, whose reporting and click behaviour is improving — so the devices most likely to be carrying an infection get checked first. For compliance evidence across Essential 8, SMB1001 or insurer reviews, a cyber security gap assessment maps what is already covered and what to close.
FAQ
What is spyware in simple terms? Software that secretly watches what you do on your device — passwords, messages, browsing — and reports it to someone else. It is designed to stay invisible for as long as possible.
How does spyware get on your phone? Mostly through fake or repackaged apps, phishing links, and — in stalkerware cases — someone physically installing it while you are not looking. Official app stores filter most of it, but not all.
What is the difference between spyware and a keylogger? A keylogger records keystrokes only; spyware is the broader class that also captures screenshots, saved passwords, browsing data, location and session tokens. Keyloggers are one subtype of spyware.
Does antivirus detect spyware? Known spyware, usually yes. Freshly built info stealers can evade signature detection, which is why behavioural detection and staff reporting matter alongside the antivirus product.
How do I remove spyware? Scan with updated endpoint tools, remove unknown apps and extensions, and then rotate every credential used on the device from a different, clean machine. For phones, a factory reset after backing up data is the thorough option.
Is stalkerware illegal? Installing surveillance software on another adult's device without their consent is illegal in Australia under surveillance device and telecommunications laws, regardless of the relationship between the parties.
One last thing
Spyware wins by staying quiet, so the cheapest defence is to break the silence: ask your team this week whether anyone has a device that has been "slow lately" — and treat every yes as a scan request, not a hardware complaint. The infection that gets reported on day one costs an afternoon; the one that gets tolerated for a month costs the average $56,600 small business breach.
Related guides
- What is a keylogger? — the keystroke-capturing subtype, explained.
- Human risk reporting — measure who reports and who clicks, per person, monthly.