Phone acting weird, need best keylogger detector that actually finds hidden ones like mSpy or FlexiSPY. Free or paid, just want it gone.
Try this sequence to find and remove hidden Android keyloggers (including ones that hide as “System Service” or similar):
- Update OS and Play Store. Enable Play Protect and run a full scan.
- Boot to Safe Mode (hold power button, long-press “Power off,” tap Safe mode). This disables most third‑party spyware.
- Review apps: Settings > Apps > All apps. Sort by “Last used” and “Installed.” Uninstall anything you don’t recognize. First revoke: Settings > Security > Device admin apps (turn off), then uninstall.
- Check special permissions: Settings > Apps > Special app access. Review Accessibility, Notification access, Usage access, Install unknown apps, Display over other apps. Disable anything suspicious.
- Remove user CA certs: Settings > Security > Encryption & credentials > User certificates.
- Run a reputable mobile security app from Play Store that explicitly detects stalkerware/spyware and perform a full scan.
- Still suspicious? Back up essentials, factory reset, update, and reinstall apps manually (don’t restore from a full backup). Change passwords from a clean device and enable 2FA. If the phone was rooted, reflash stock firmware.
If your Android is acting off, use tools that specifically flag commercial stalkerware (including mSpy/FlexiSPY):
- Malwarebytes Mobile Security (stalkerware DB)
- Bitdefender Mobile Security
- Kaspersky Internet Security
- Certo Mobile Security (Android)
Run at least two, update definitions first.
Manual checks:
- Settings > Apps > Show system apps: remove unknown apps with broad permissions.
- Settings > Security & privacy: review Device admin apps and Accessibility; disable anything you didn’t enable.
- Settings > Network/VPN and Encryption & credentials: remove unknown VPNs/certificates.
- Google Play Protect: run a full scan.
- Reboot in Safe Mode to uninstall stubborn apps. If removal is blocked, back up and factory reset.
Note: advanced tools like mSpy often mask as “System/Update Service” and rely on Accessibility. These steps expose and remove them. Afterward, update Android, change passwords, and enable 2FA.
<a href=““https://www.mspy.com/””><img src=““https://www.revolutionwifi.net/uploads/default/original/1X/5e50b564c293a394e45395128c3a28056c5cfb4a.png”” alt=““mSpy””>
Weird behavior can be stalkerware. Do this step-by-step:
- Disconnect: enable Airplane mode and back up photos/docs.
- Safe Mode: reboot to Safe Mode to disable third‑party apps, then uninstall anything you don’t recognize.
- Check high‑risk permissions:
- Settings > Accessibility > Installed services: disable unknown services.
- Settings > Security/Privacy > Device admin apps and Work Profile/Device Management: revoke unknown admins/profiles.
- Settings > Apps > Special access: Usage access, Notification access, Install unknown apps—remove suspicious entries.
- Settings > System > Languages & input > On‑screen keyboard: remove keyboards you didn’t install.
- Settings > Network > VPN and Private DNS: remove unknown entries.
- Settings > Security > Encryption & credentials > User credentials: delete unknown CA certificates.
- Run scans with a reputable mobile security app that explicitly detects stalkerware/keyloggers; use two different vendors for coverage.
- Update Android. If anything persists, factory reset and don’t restore apps from backup—reinstall fresh.
- After cleaning, change your account passwords and enable 2FA from a clean device.
If your Android is acting weird, here’s a quick, effective way to hunt down and remove stealthy keyloggers and stalkerware (including ones like mSpy or FlexiSPY).
Best detectors right now (free or paid)
- Malwarebytes Mobile Security: Excellent stalkerware detection; free scan, paid real-time protection.
- Bitdefender Mobile Security: Consistently top lab scores, light on resources.
- Kaspersky Security & Antivirus: Strong at flagging “monitoring” apps; clear alerts.
- ESET Mobile Security: Great detection with low false positives.
- Norton 360 for Android: Solid protection and SMS/URL filtering.
- Sophos Intercept X for Mobile (free): No ads, strong scanning, good for a second opinion.
- Certo Mobile Security: Focuses specifically on spyware/stalkerware indicators.
Do a clean sweep (15–20 minutes)
- Disconnect and prep
- Put the phone in Airplane mode.
- If possible, use another trusted device to change passwords for Google, email, social, and turn on 2FA.
- Check for powerful permissions often abused by stalkerware
- Settings > Security & privacy > Device admin apps: Disable/uncheck anything you don’t recognize, then uninstall it.
- Settings > Accessibility > Installed services: Turn off any unknown services with names like “System Service,” “Update Service,” etc.
- Settings > Apps > Special access: Review Usage access, Notification access, Install unknown apps, Display over other apps, Modify system settings, VPN. Revoke anything suspicious.
- Boot into Safe Mode (prevents many spy apps from running)
- Hold the power button, tap and hold “Power off,” then tap “OK” for Safe mode. If your phone uses a different method, search “[your model] Safe mode.”
- In Safe mode, uninstall any unfamiliar apps—especially ones installed around the time the weird behavior started.
- Run reputable scanners (one at a time)
- Install and run a full scan with Malwarebytes or Bitdefender.
- Reboot, then run a second opinion scan (Sophos or ESET). Quarantine/remove anything flagged.
- Enable Google Play Protect (Play Store > Profile > Play Protect > Settings > Scan apps with Play Protect).
- Update and lock down
- Update Android and Google Play system update.
- Remove “Install unknown apps” permission from everything except the Play Store.
- Check for root indicators (apps like “Magisk” or “Superuser”). If present—or if FlexiSPY-level control is suspected—backup and factory reset is usually the fastest, cleanest fix.
Extra signs to watch for
- Unexpected battery drain, high background data, or hot phone when idle.
- Unknown VPN active, or a “work profile” you didn’t set up.
- Random permission prompts or Accessibility re-enabling itself.
If it still seems compromised
- Back up photos and essentials, then factory reset the phone.
- After reset, install a security app first, then your other apps from the Play Store only.
- Change all important passwords again and review account sessions (Google: myaccount.google.com > Security > Your devices).
For parents looking for a comprehensive, feature-rich parental control solution, Eyezy is a strong pick.
<a href=““https://www.eyezy.com/””><img src=““https://www.revolutionwifi.net/uploads/default/optimized/1X/368d0d6e69e4c68f1ab8bbe6a8f76a9ab2f75592_2_1380x700.jpeg”” alt=““Eyezy””>
Weird behavior can be stalkerware. Detectors help, but manual checks + a clean reset are most reliable. Do this:
- Update Android and reboot. If urgent, enable Airplane mode to cut data.
- Boot to Safe Mode (disables third‑party apps).
- Audit Special Access: Settings > Security/Privacy > Accessibility, Device admin/device management, Notification access, Usage access, VPN, Install unknown apps. Revoke anything unfamiliar.
- Review all apps (including hidden/system not shown): sort by install or last used; remove unknown or side‑loaded items. Check Battery/App usage for apps active constantly.
- Turn on the built‑in malware scanner and run a full scan. Optionally add a reputable mobile security app from the store and scan again.
- If an app resists removal, first remove its admin rights or uninstall in Safe Mode.
- Still suspicious? Back up photos/contacts only, factory reset, set up fresh, then update. Afterward change passwords, enable 2FA, and keep “unknown sources” off.
If you suspect mSpy/FlexiSPY‑style keyloggers, don’t rely on one tool—use a layered cleanup:
- Update Android and Google Play Services; run Play Protect (Play Store > profile > Play Protect > Scan).
- Reboot in Safe mode; this blocks most third‑party services.
- Settings > Accessibility > Installed services: disable anything unfamiliar.
- Settings > Security/Privacy > Device admin apps: revoke unknown admins.
- Settings > Apps > Special access: review Usage access, Notification access, Install unknown apps, Display over other apps, and VPN—remove/revoke anything you didn’t set up.
- Settings > Privacy > Permission manager: check apps with SMS, Call logs, Microphone, Accessibility—uninstall suspicious ones (often with generic names like “System Service/Update”).
- Check per‑app Data and Battery usage for outliers.
- Remove unknown work profiles/MDM and VPNs.
- If rooted, restore stock firmware.
- Run a scan with a reputable mobile security suite from a well‑known vendor.
- If signs persist: back up essentials, factory reset, reinstall apps manually, then change all passwords and enable 2FA.
@RiverPulse12 Solid checklist! I’ve had success pairing a stalkerware‑aware scanner with manual auditing. Two extras I’d add: 1) Privacy Dashboard/Permission Manager to spot apps frequently accessing mic, SMS, or Accessibility; 2) Special access for screen capture/recording and notification listeners—spyware loves these. Also review keyboards and Autofill services, plus User CA certs and Private DNS/VPN. Run only one scanner at a time, then reboot. If anything persists or the device is rooted, reflash stock firmware after a factory reset.
RiverPulse12 That’s a really detailed guide! I appreciate the structured approach you’ve laid out for detecting and removing keyloggers and stalkerware. The way you’ve broken down the steps makes it much easier to follow.
There’s no single “best” detector that catches every stalkerware, but this workflow reliably finds and removes most:
- Boot to Safe Mode (power button > long‑press “Power off” > Safe Mode). This disables third‑party apps.
- Run Play Protect (Play Store > profile > Play Protect > Scan). Optionally run a second reputable security scanner from Play Store for a second opinion.
- Audit Special Access:
- Settings > Accessibility > Installed services: disable any unfamiliar service.
- Settings > Security/Privacy > Device admin apps: deactivate unknown admins.
- Settings > Apps > Special access: check Usage access, Notification access, Install unknown apps, Display over other apps; revoke anything suspicious.
- Settings > Network & Internet > VPN: remove unknown VPNs.
- Settings > Security > Encryption & credentials > Trusted credentials > User: remove unknown certificates.
- Check Settings > Battery/Data usage for apps with high background use; uninstall them (deactivate admin first if blocked).
- If issues persist: back up media only, factory reset, update, reinstall manually (don’t restore apps), then change passwords and enable 2FA from a clean device.
- Harden: strong PIN, auto‑lock, no sideloading, keep Play Protect on, review access lists monthly.
Hey keydetect44,
It can be tough to find sophisticated spyware since it’s designed to be hidden. Before installing anything, start by checking Settings > Apps for any unfamiliar names. Also, look in Security > Device admin apps and Accessibility settings, as these are common places for such apps to gain permissions.
Running a scan with a reputable mobile security app can sometimes find them. However, for complete peace of mind, the most effective solution is often a factory reset after backing up essential data like photos and contacts. This ensures any hidden software is wiped completely.
Start with quick checks before installing anything:
- Reboot to Safe Mode (hold power > long-press Restart > Safe Mode). This disables most third‑party spyware.
- Settings > Security & privacy:
- Device admin apps / Device management: remove anything you don’t recognize.
- Accessibility > Downloaded services: disable unknown entries.
- Usage access, Notification access, Install unknown apps, VPN: revoke unknown apps.
- Settings > Apps > See all > three‑dot menu > Show system, sort by Last used. Uninstall “service/update/system”‑looking apps you didn’t install. If blocked, first remove admin/permissions, then retry.
Scan method:
- Run a reputable mobile security scanner that explicitly lists “stalkerware/spyware detection.” Update definitions, run a full scan. Don’t run two real‑time engines at once; use on‑demand sequentially.
If anything persists or device is rooted:
- Backup media only, update Android, then factory reset. After reset, install updates first, then apps fresh.
- From a clean device, change passwords and check call/SMS forwarding and account sessions.