Note (October 2026): An earlier version said .doc and .dot files contain 37% of all spyware; Symantec’s 2019 report actually found they made up 37% of blocked malicious email attachments. Breach and spending figures have also been updated.
Spyware is malicious software that secretly collects information about a person or organization, such as keystrokes, passwords, browsing activity or messages, and sends it to someone else. The best protection is to keep devices and apps updated, install software only from trusted sources, avoid unexpected links and attachments, run reputable security software and turn on two-factor authentication.
Key Takeaways
- Spyware is a type of malware built to gather information without the user’s knowledge and pass it to a third party.
- Common types include adware, keyloggers, tracking software, trojans, system monitors and stalkerware.
- Spyware usually arrives through email attachments, bundled downloads, malicious websites or unpatched vulnerabilities.
- Warning signs include a slow or crashing device, browser redirects, unexpected pop-ups and messages you did not send.
- If spyware is suspected, stop signing in to sensitive accounts, run a security scan, then change passwords and enable two-factor authentication.
The modern digital age has seen the value of data, be it personal or business, skyrocket. As that value has risen, so has the incentive for criminals to steal it.
According to Verizon’s 2020 Data Breach Investigations Report, 86% of all data breaches within the world of business in its dataset of 3,950 breaches were financially motivated. Verizon’s 2026 report, which covers incidents from November 2024 to October 2025, found that ransomware was present in 48% of breaches and that 31% began with the exploitation of a software vulnerability.
Spyware is one of the tools attackers use to get into a company’s or a person’s systems and quietly collect data. Spyware, along with its counterparts of malware and ransomware, is designed to run without the owner’s knowledge and to take data from the systems it infects.
One click by one employee can be enough to let spyware onto a business network, which is why awareness matters as much as software.
What Is Spyware?
You may be asking yourself, “What is spyware, and why is it so dangerous?” Spyware is a type of malware that gathers information about a person or organization and sends it to someone else without the user’s knowledge. It usually installs itself quietly, often hidden inside something the user chose to download.
Spyware is often bundled with legitimate-looking software so it goes unnoticed. Common delivery routes are email attachments, download links on websites, apps that seem harmless, and browser or operating-system vulnerabilities that let malicious code run when a page is visited.
Spyware comes in several forms, each targeting different information. Three of the most commonly discussed types are described below.
- Keyboard Loggers – A keylogger is a program that copies every key tapped and action taken on the infected device and transcribes it on the attacker’s computer. With this, any time that a user types in their password, a username, or even an email, the hacker will know about it. This is a common way that hackers farm company information and use it to break into user accounts with lots of permissions.
- Internet Cookies – Tracking cookies and similar tracking software follow a user’s browsing across websites and build a profile of their activity. Ordinary cookies are small text files, not programs, so they cannot read passwords by themselves; the real danger comes from tracking or session-stealing malware that copies browser data, saved logins and session cookies, which attackers can then use to get into accounts.
- Adware – Adware is usually considered the least dangerous type of spyware and is less often used in targeted attacks on businesses. Adware displays unwanted advertising, can slow a device noticeably, and may change the browser’s home page or redirect searches. The ads themselves can lead to further malicious downloads, so adware is worth removing promptly.
This is not an exhaustive list. Other forms include system monitors, trojans disguised as useful programs, banking malware that targets financial logins, stalkerware secretly installed on a partner’s phone, and commercial mobile spyware such as NSO Group’s Pegasus.
How Can You Protect Yourself From Spyware?
Most spyware protection comes down to a few everyday safety habits.
Three of the most useful habits for email and browsing are listed first; further steps follow later in this guide.
- Be Conscious of Emails.
- Use Email Firewalls.
- View Links.
Let’s break these down further.
Be Conscious of Emails
Treat unexpected emails with caution. If a message pushes urgency, such as claiming an account has been breached, the bank has detected fraud, or a password must be reset right now, stop and check whether the email is genuine before acting.
Inspect the sender’s full email address closely, not just the display name. Equally, if the email is asking you to navigate to a particular site, you should navigate from your own search engine, not through any links. Be very careful when clicking on links within an email, as you could easily launch a download onto your computer.
Knowing which file types attackers favor also helps. According to Symantec’s 2019 Internet Security Threat Report, Microsoft Office .doc and .dot files accounted for 37% of blocked malicious email attachments.
Use Email Firewalls
Most major email services already filter messages and move likely spam, phishing and malicious attachments out of the inbox. Check what filtering a provider offers, and for a business consider a dedicated email-security service that scans attachments and links.
With worldwide information security spending forecast by Gartner at roughly $244 billion to $248 billion for 2026, there is no shortage of email-security options; compare what each one scans before paying.
View Links
A small but useful habit is hovering over a link before clicking it. Desktop browsers and most email programs show the real destination address, usually in the bottom corner of the window; on a phone, a long press on the link shows it.
Some browsers and email apps can also show a preview of the destination page. Taking a few seconds to check a link before clicking helps avoid look-alike domains and compromised pages.
Final Thoughts
Spyware is one of many tools attackers use to get into personal and business devices.
Once spyware is on a system, it can be difficult to get rid of it, meaning that preventative measures are always the most effective strategy for keeping your systems safe.
Whether the goal is keeping personal devices spyware-free or protecting a business and its employees, the habits outlined in this guide go a long way.
How Does Spyware Get Onto a Device?
Spyware rarely spreads by itself the way a worm does. Spyware usually relies on the user installing it without realizing, or on a security hole that lets it run. The most common routes are:
- Bundled software: free programs downloaded from unofficial sites that carry extra, unwanted components.
- Trojans: malicious programs disguised as something useful, such as a fake update, codec or game mod.
- Email attachments and links: documents or links in phishing emails that install malware when opened.
- Malicious or compromised websites: pages carrying exploit code that targets outdated browsers or operating systems.
- Physical access: stalkerware is often installed by someone who has had the phone in their hands.
Phishing is the starting point for many of these attacks; this guide on protecting employees from spear phishing scams explains how targeted phishing emails work.
Types of Spyware Compared
| Type | What it does | Typical risk |
|---|---|---|
| Adware | Shows unwanted ads, changes browser settings, tracks activity for ad targeting | Lower, but can lead to further malware |
| Keylogger | Records every key pressed, capturing passwords and messages | High: account takeover |
| Tracking software | Monitors browsing and web activity | Privacy loss, profiling |
| System monitor | Records broad computer activity such as apps used, screenshots and chats | High |
| Trojan | Poses as legitimate software to install spyware or other malware | High |
| Stalkerware | Secretly monitors a person’s phone, often in an abusive relationship | High: personal safety |
| Commercial spyware (e.g. Pegasus) | Covertly installed on phones to surveil selected targets | Rare, but severe for those targeted |
What Are the Signs of Spyware?
Spyware is built to stay hidden, so there may be no obvious symptoms. The US Federal Trade Commission lists these warning signs of malware, including spyware:
- The device slows down, freezes or crashes.
- The browser’s home page changes, or the browser redirects to sites you did not intend to visit.
- New toolbars appear, pop-ups multiply, or system tools stop working.
- Emails or social media messages appear that you did not write or post.
On phones, unfamiliar apps, unexpected permission requests and settings you did not change are also worth checking.
How Do You Remove Spyware?
The FTC recommends a short sequence of steps when malware is suspected:
- Stop signing in to sensitive accounts, such as banking and email, on the affected device.
- Download or update security software from a trusted source.
- Run a full security scan and let the software remove what it finds.
- Change your passwords and turn on two-factor authentication.
- If the problem continues, get help from the device maker, a trusted technician or a knowledgeable contact.
In the United States, suspected malware can be reported to the FTC at ReportFraud.ftc.gov. To see whether any passwords have already leaked, follow this guide on how to check if your passwords have been compromised, and use the secure password generator to create strong replacements. For a broader recovery plan, read what to do if you’ve been hacked.
Stalkerware needs extra care. The Coalition Against Stalkerware warns that removing stalkerware or making significant changes may be detected by the person who installed it and could increase abuse and harassment, so anyone in that situation may want to plan with a domestic abuse support service first.
How to Protect Phones From Spyware
Phones are a major target because they hold messages, photos, location and two-factor codes. The basics are the same as on a computer: keep the operating system updated, install apps only from official stores, and review app permissions.
- Android: Google Play Protect is on by default. According to Google, Play Protect runs a safety check on Play Store apps before download, checks the device for potentially harmful apps from other sources, warns about them and may deactivate or remove them. It can be checked under Play Store, profile icon, Play Protect, Settings.
- iPhone, iPad and Mac: Apple’s Lockdown Mode is an optional, extreme protection for the very few people who might be personally targeted by sophisticated spyware, such as journalists or activists. Apple notes that most people are never targeted this way. Lockdown Mode is available on iOS 16, iPadOS 16, watchOS 10 and macOS Ventura or later, and it blocks most message attachments, limits some web technologies and blocks FaceTime calls from unknown contacts.
Spyware Protection Checklist
- Install operating system, browser and app updates promptly; unpatched software is a common entry point.
- Download software only from official websites and app stores, and avoid peer-to-peer downloads.
- Do not open unexpected attachments or click links in unexpected emails or texts.
- Never call a phone number shown in a pop-up warning.
- Keep reputable security software installed and updated.
- Use unique passwords, a password manager and two-factor authentication, so stolen passwords alone are not enough.
- Scan USB drives and other external devices before opening files from them.
- For businesses, train staff, filter email and limit administrator rights; this cybersecurity guide for remote employers covers distributed teams.
Frequently Asked Questions
What is spyware in simple terms?
Spyware is software that secretly watches what a person does on a device, such as typing, browsing or messaging, and sends that information to someone else without permission. Spyware is a category of malware.
Is spyware the same as a virus?
No. A virus is malware that spreads by copying itself, while spyware is defined by its purpose of collecting information. Spyware usually does not self-replicate and instead relies on being installed through bundled downloads, trojans or exploits.
Can spyware be installed on a phone?
Yes. Spyware can reach phones through malicious apps, phishing links or someone with physical access installing stalkerware. Keeping the phone updated, using official app stores and reviewing app permissions reduce the risk.
Does a factory reset remove spyware?
A factory reset is one of the most effective ways to clear spyware from a phone. The Coalition Against Stalkerware describes a factory reset as an effective removal method and advises backing up important data, such as contacts and photos, first. Changing account passwords afterward is still wise, because a reset does not undo data that was already taken.
How do I know if my computer has spyware?
Common signs are a slow or crashing computer, browser redirects, new toolbars, many pop-ups and messages you did not send. Spyware can also run without symptoms, so a scan with reputable security software is the most reliable check.
Is Pegasus spyware a risk for ordinary users?
Commercial spyware such as NSO Group’s Pegasus has been used against selected targets such as journalists and human rights activists. Apple states that most people are never targeted by attacks of this nature, but everyone benefits from installing updates promptly.
Justwebworld has published guides since 2012. How we write and update articles Report an error
