What Is Spyware?

Spyware covertly collects information about a person's activity and transmits it elsewhere. The defining characteristic is concealment: it is designed to run without the subject knowing.

It spans a wide range, from commodity credential stealers through commercially sold monitoring products to sophisticated tooling used against specific individuals. The defences differ substantially across that range.

What it collects

Keystrokes, which yields credentials — see keylogger. Screen contents. Browsing activity and stored browser credentials. Messages, contacts and files.

On mobile devices: location, microphone, camera, and the contents of messaging applications, which is frequently the objective since it defeats end-to-end encryption by reading the plaintext on the device.

Commodity stealers are the volume problem

Widely available tooling that harvests stored browser credentials, session cookies, cryptocurrency wallets and saved passwords, typically delivered through fake software downloads and cracked applications.

The output is sold in bulk, which means a personal infection becomes a corporate problem when the browser held corporate credentials and session tokens. Stolen session cookies are particularly damaging because they bypass authentication entirely.

Commercial monitoring software

Products sold for monitoring employees, children or partners occupy an awkward space: technically identical to spyware, marketed as legitimate, and frequently installed without the subject's knowledge.

Employee monitoring carries legal obligations around notice and proportionality in most jurisdictions. Installation on a device belonging to a partner or family member is unlawful in many, and the category is a recognised element of domestic abuse.

Targeted mobile surveillance

Tooling sold to state customers has repeatedly been found on the devices of journalists, lawyers and activists, sometimes requiring no interaction from the target at all.

For most organisations this is not the threat model. For those whose staff may be targeted, the practical measures are keeping devices current, enabling the hardened modes major platforms now offer, and restricting what corporate data reaches personal devices.

Detection and response

Behavioural indicators: processes accessing browser credential storage, unexpected outbound connections carrying volume, unfamiliar persistence entries, battery and data consumption anomalies on mobile.

Response has to assume everything the device could see is compromised: reset passwords entered on it, revoke sessions, and treat stored credentials as exposed rather than merely at risk.

Notice, consent and the legal boundary

Monitoring software deployed by an employer on corporate devices is lawful in most jurisdictions with appropriate notice and proportionality, and unlawful without them. The notice is the part most often missing, which converts a defensible control into an employment and privacy problem.

Where monitoring is deployed, the decisions worth documenting are what is collected, who may access it, how long it is retained and what it may be used for. Those are the questions a regulator or a tribunal asks, and they are difficult to answer retrospectively.

Removal is frequently incomplete. Commercial monitoring products in particular are built to survive attempts to uninstall them, and mobile surveillance tooling can persist across a reset in some cases. Where a device is suspected and the stakes are high, replacing it is more reliable than cleaning it.

Where to start

Establish whether corporate applications can be accessed from unmanaged personal devices with a persistent session. That is the path a commodity stealer uses to reach you.

See session management. GuardsArm delivers managed detection and response.