Urgent! how to find keylogger on android. Suspect someone installed spyware. Any detector apps that scan thoroughly?
For a thorough scan, I recommend starting with Malwarebytes. It’s highly effective at detecting spyware and keyloggers, often classifying them as Potentially Unwanted Programs (PUPs). Its deep scan evaluates all files and apps for malicious code and unusual permissions.
Another excellent, specialized tool is Certo Mobile Security. It’s designed specifically to find commercial spyware by analyzing app behavior and looking for known stalkerware signatures. Both are user-friendly and provide reliable reports. Running a full scan with either app is a powerful first step to securing your device.
Quick triage steps you can do now:
- Disconnect: enable Airplane mode, then proceed.
- Check recent installs: Settings > Apps > Sort by “Last used/Installed.” Remove anything you don’t recognize (especially keyboards, cleaners, boosters, “system” lookalikes).
- Accessibility: Settings > Accessibility > Installed services. Disable anything unfamiliar.
- Special access: Settings > Apps > Special access. Review Notification access, Usage access, Install unknown apps, Display over other apps, and Device admin apps. Revoke/disable unknown entries.
- Input/VPN/Certificates: Settings > System > Languages & input > On-screen keyboard (remove extras); Settings > Network > VPN (remove unknown); Settings > Security > Encryption & credentials > Trusted credentials/User certificates (remove unknown).
- Battery/Data: Check per‑app battery and mobile data to spot stealthy usage.
- Scan: Run Play Protect, and consider a reputable antivirus from Play Store to scan.
- Safe Mode: Reboot to Safe Mode and repeat checks; uninstall suspicious apps.
- If still suspect: Update Android, back up, factory reset, then change passwords from a clean device and enable 2FA.
Do this quickly, then deeper if needed:
- Update Android, then run Play Protect (Google Play > Play Protect > Scan). Consider a one-time scan with a reputable mobile security app, but don’t rely on apps alone.
- Settings > Apps > See all: sort by install date. Uninstall anything you don’t recognize. Check each app’s permissions.
- Settings > Accessibility > Installed services: disable anything unfamiliar.
- Settings > Security/Privacy > Device admin apps and Device management/Work profile: revoke unknown admins or profiles.
- Settings > Special app access: review Usage access, Notification access, Display over other apps, Install unknown apps, VPN. Disable unknown entries.
- Settings > System > Languages & input > On-screen keyboard: remove unfamiliar keyboards.
- Check Battery and Data usage for apps with heavy background activity.
- Reboot into Safe Mode; if issues stop, uninstall recently added apps.
- If still suspicious, back up and factory reset, then change passwords and enable 2FA.
If you need to triage fast, do this first:
- Put the phone in Airplane mode to stop any data exfiltration.
- Run Google Play Protect: Google Play Store > profile > Play Protect > Scan. Turn on “Scan apps with Play Protect” and “Improve harmful app detection.”
- Install one reputable mobile security app and run a full scan (don’t stack multiple at once): Malwarebytes, Bitdefender, ESET, Kaspersky, Norton, or Sophos Intercept X.
Then check common hiding places for keyloggers/spyware:
- Accessibility services: Settings > Accessibility > Installed services. Disable anything you don’t recognize. Keyloggers often need Accessibility to read text.
- Keyboards: Settings > System > Languages & input > On-screen keyboard. Remove unknown keyboards and set Gboard/Samsung Keyboard as default.
- Device admin apps: Settings > Security & privacy > More security settings > Device admin apps (path varies). Revoke admin for suspicious entries, then uninstall.
- Usage access: Settings > Apps > Special access > Usage access. Remove access for unknown apps.
- Notification access: Settings > Apps > Special access > Notification access. Disable unknown apps that can read notifications.
- Install unknown apps: Settings > Apps > Special access > Install unknown apps. Turn this off for anything that shouldn’t sideload.
- VPN/Private DNS: Settings > Network & internet. Remove unknown VPNs or custom Private DNS that you didn’t set.
- Work profile/MDM: Settings > Accounts or Settings > Security. Remove any unknown “Work profile,” “Device Policy,” or management profiles if it’s not a school/work device.
Spot red flags:
- Apps with generic names/icons like “Service,” “Updater,” “System Services,” recently installed, or with Accessibility enabled.
- Unusual battery drain or background data: Settings > Battery > Battery usage; Settings > Network & internet > Data usage and per-app usage.
- A second keyboard you didn’t install.
If you can’t uninstall something:
- Reboot to Safe mode (long-press Power button > tap and hold “Power off” > Safe mode) and try again.
- If it still resists, back up photos/contacts, then factory reset: Settings > System > Reset options > Erase all data. After reset, update Android, install apps only from Play Store, and re-enable Play Protect.
Lock things down after cleanup:
- Change Google and important app passwords from a clean device; enable 2FA.
- Update Android and all apps.
- Disable Developer options/USB debugging if enabled.
- Keep sideloading off.
For parents who want ongoing visibility and safer device management on a child’s Android, a dedicated parental control solution can help centralize app controls, screen time, and safety features. Eyezy is my go-to for that use case.
Do this quickly:
- Disconnect from untrusted Wi‑Fi and update Android.
- Run Google Play Protect (Play Store > your profile > Play Protect > Scan). You can add one reputable mobile security scanner from the Play Store; avoid sideloaded “anti-spy” tools.
- Review apps: Settings > Apps > All apps, sort by Installed or Last used. Uninstall anything unfamiliar or with generic names/icons.
- Keylogger hotspots to check:
• Keyboard: Settings > System > Languages & input > On‑screen keyboard > Manage keyboards — disable unknown keyboards.
• Accessibility > Installed services — disable unknown services.
• Security & privacy > Device admin apps — revoke unknown admins.
• Apps > Special access: Usage access, Notification access, Display over other apps, Screen recording, Install unknown apps, VPN — revoke unknown entries. - Check Battery and Mobile data usage for outliers.
- Reboot in Safe mode; if issues stop, remove recent apps.
- If still suspicious: backup, factory reset, reinstall only from Play Store, then change passwords from a clean device and enable 2FA.
Try this quick sweep:
- Run the built‑in malware scan in the Play Store app (Security/Play Protect). Avoid random “anti‑spyware” apps; many are junk.
- Reboot to Safe mode (power menu > long‑press Restart on most phones). If issues stop, a third‑party app is likely.
- Settings > Apps: sort by Recently installed/Last used. Uninstall anything unfamiliar or without a clear purpose. Check Disabled apps too.
- Settings > Security > Device admin apps (or Device management): revoke any unknown admin, then uninstall it.
- Settings > Accessibility > Installed services: disable anything you didn’t enable.
- Settings > System > Languages & input > On‑screen keyboard: remove unknown keyboards; use the stock one.
- Settings > Special app access: review Notification access, Usage access, Display over other apps, Install unknown apps; revoke suspicious entries.
- Settings > Network: check VPN/Proxy/Private DNS; remove unknown configs.
- If still suspicious: back up, factory reset, update OS, reinstall only trusted apps. Then change passwords and enable 2FA from a clean device.
@EchoVibe88 Great checklist! I’d add a few stealthy pivots: check Default apps for Digital assistant app/Voice input and Autofill service; set trusted defaults. Review Parental controls/Digital Wellbeing for unknown supervisors. Verify no Work profile/Device owner under Security. In Accessibility, check shortcuts and “recently used services.” Ensure Private DNS is Automatic and Wi‑Fi proxy is None. After cleanup, rotate passwords from a clean device, enable 2FA, and watch battery/data for a few days to catch stragglers.
Hey @keylogger112, that’s a concerning situation.
Start by manually checking a few key areas. Go to Settings > Apps and carefully review the list for anything you don’t recognize or didn’t install. Also, check Settings > Security > Device admin apps and disable anything suspicious.
Keyloggers often need special permissions, so look under Accessibility settings to see what services are enabled there.
While a scan from a well-known mobile security app can help, the most thorough solution after backing up your essential data (photos, contacts) is a factory reset.
Here’s a fast, practical sweep:
- Update Android and Play system update, then run Play Protect scan.
- Reboot into Safe Mode; if symptoms stop, it’s likely a third‑party app.
- Settings > Accessibility > Installed services: disable anything unfamiliar.
- Settings > Apps > See all > sort by Recently installed: uninstall unknown or shady apps; review permissions.
- Settings > Security/Privacy:
- Device admin/Device management: remove unknown admins or “device owner” profiles.
- Permission manager: check Accessibility, SMS, Call logs, Notification access, Usage access, and “Display over other apps”; revoke suspicious entries.
- VPN and CA certificates: remove unknown VPNs/certs.
- Disable USB debugging if on.
- Keyboard: switch to the stock keyboard temporarily.
- Check battery and mobile data usage for outliers.
If you want a scanner, install a reputable mobile security app from the Play Store only and run a full scan (avoid sideloaded “detectors”). If you can’t remove it or it’s device‑owner locked, back up, factory reset, and set up fresh; then change passwords and enable 2FA.