Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
For defensive spyware detection on Android, Malwarebytes Mobile Security delivered the strongest result in the independent AV-Comparatives test published in September 2025, detecting 100% of the tested commercial stalkerware samples. Bitdefender Mobile Security, ESET Mobile Security, Kaspersky Mobile Security and McAfee Mobile Security each detected 94%. Those figures describe one dated test of particular app versions and samples, not a permanent ranking or a guarantee that a clean phone is safe.
“Spyware” in this context means stalkerware installed without the device owner’s knowledge. It can expose location, messages, email, photos, videos, browsing activity and microphone recordings. Detection is only one part of the decision: safe timing, understandable alerts, resistance to tampering and a removal process that does not put someone at risk matter just as much.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →What is the best spyware app for Android?
If you mean the best defensive scanner for finding stalkerware on an Android phone, Malwarebytes Mobile Security is the evidence-based first choice from the September 2025 AV-Comparatives test, with a 100% detection rate in that test. Four other products reached 94%, while Google Play Protect detected 53% of the samples.
That result should be read as a benchmark, not a promise. The test covered 13 Android security products, a defined set of commercial stalkerware samples and specific versions. Modified, newly released or account-based monitoring can behave differently, and no product in the test removed stalkerware automatically.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What did the September 2025 independent test find?
AV-Comparatives tested Android security products against commercial stalkerware. Some samples interfered with security software, so the results also indicate how products cope with hostile or evasive apps. Most products issued generic warnings rather than clearly identifying stalkerware or explaining why the alert mattered.
| Android security product | Detection in AV-Comparatives test | Important context |
|---|---|---|
| Malwarebytes Mobile Security | 100% | Highest result in the September 2025 test |
| Bitdefender Mobile Security | 94% | Tied second in the test |
| ESET Mobile Security | 94% | Tied second in the test |
| Kaspersky Mobile Security | 94% | Installed from the vendor’s website because it was unavailable on Google Play at test time |
| McAfee Mobile Security | 94% | Tied second in the test |
| Avast Mobile Security | 88% | Part of the next performance group |
| Avira Antivirus Security | 88% | Part of the next performance group |
| F-Secure Total Security | 88% | Part of the next performance group |
| Norton 360 Mobile Security | About 82% | Approximate result reported for the product |
| Sophos Intercept X for Mobile | About 82% | Approximate result reported for the product |
| G DATA Mobile Security | 65% | Detected roughly two-thirds of tested samples |
| Trend Micro Mobile Security | 59% | Detected fewer than six in ten tested samples |
| Google Play Protect | 53% | Built-in Android protection in the test |
The spread is substantial: the highest-scoring product detected every sample, while Play Protect detected just over half. A percentage does not show whether an alert was clear, whether the app resisted interference, or whether removal was safe. Those practical differences can determine what a person does next.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteHow should I interpret a spyware detection percentage?
First, check the test date, product version, operating-system setup and sample set. The September 2025 figures are not a lifetime score; a later update, a new stalkerware family or a modified package can change performance.
Second, distinguish detection from identification. The report found that most products generated generic “threat detected” style alerts. A warning that says an app may monitor location, messages or microphone activity gives a user more useful context than an unexplained malware label.
Third, treat a clean result as limited evidence. A scanner can miss a newly released or altered package, monitoring that is controlled through an online account rather than a visibly suspicious app, or a sample outside the tested set. Use the scan as one check in a broader review of the phone and its accounts.
What is stalkerware, and why is it dangerous?
The Federal Trade Commission defines stalkerware, also called spyware, as software installed on a phone or other device without the owner’s knowledge. Depending on the product, it may expose location, microphone recordings, messages, email, photos, videos and browsing activity to another person.
Covert monitoring is not the same as an authorized family-safety, employer-management or accessibility tool configured with informed consent. Buying surveillance software may be legal in some places, but using it to monitor someone without their knowledge is often a crime. The FTC’s 2021 order against SpyFone, Support King and Scott Zuckerman banned offering, promoting, selling or advertising the surveillance apps and required deletion of illegally collected data. In December 2025, the FTC denied a petition to vacate or modify that order.
This article covers defensive detection and removal only. It does not provide instructions for installing, hiding or evading detection with a monitoring app.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Could scanning or deleting an app put someone at risk?
Yes. The FTC warns that searching for help, calling an advocate, scanning the phone or removing an app can alert an abuser. An abrupt loss of location or message access may trigger confrontation, and a monitoring app may record the attempt to remove it.
- If you suspect an abusive partner or another person with physical access to the phone, consider using a safer device that the suspected person cannot access for research, calls and account changes.
- Contact a domestic-violence or technology-abuse advocate before making visible changes. An advocate can help plan evidence preservation, account protection and a safe time to scan.
- Do not announce that you found spyware or test the suspected person’s reaction from the monitored phone.
- Keep emergency contacts and essential transport or housing information available on a safer device if changing the phone could remove access.
A technical fix is not automatically a safe fix. If there is immediate danger, prioritize local emergency services or a qualified abuse-support organization over troubleshooting the handset.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsHow can I check an Android phone safely?
Use the following sequence only when it is safe to do so. Android manufacturers change menu names, so labels such as “Apps,” “All apps” or “Device admin apps” can differ slightly.
- Make a safety plan first. Decide whether the suspected person can see the phone, its notifications, the Google account, the mobile bill or the Wi-Fi router. If that access is possible, move planning and support conversations to a safer device.
- Update the phone and its security tools. Install available Android system and app updates from the phone’s normal settings and official app store. Updates can improve scanning and close vulnerabilities, but they do not prove that spyware is absent.
- Run the built-in check. Open Google Play Store, select the profile icon, choose Play Protect, and run its scan. The 2025 independent test detected 53% of the tested samples with Play Protect, so use this as a baseline rather than the only check.
- Run one reputable security scanner. Install a defensive mobile-security product from the official Google Play listing or the vendor’s verified distribution channel. Avoid links sent by the person you suspect and avoid “anti-spy” apps that demand unusual permissions or promise secret surveillance.
- Read the alert before acting. Record the product name, detection label, app package or app name and the time of the warning if doing so is safe. A generic alert may require additional review; do not assume every unfamiliar app is stalkerware.
- Review installed apps manually. Go to Settings > Apps (or Settings > Apps > See all apps) and sort through the list. Check apps you do not recognize, apps installed outside the normal store, and apps with access that does not fit their stated purpose. Take screenshots only if storing them cannot expose the plan.
- Check high-risk permissions and access. Review which apps can access location, microphone, camera, SMS, contacts, notifications and accessibility services. Also check device-administrator or similar management settings. A legitimate work-management or accessibility tool can need powerful access, so verify its owner and purpose before disabling it.
- Choose the timing of removal. The AV-Comparatives test found that users had to initiate uninstallation; products did not automatically delete stalkerware. If removal could alert an abuser or destroy evidence, pause and consult an advocate instead of tapping “uninstall” immediately.
- Remove or quarantine only when safe. Follow the scanner’s instructions, then use Settings > Apps to uninstall a confirmed app if the phone allows it. If an app has administrator privileges, revoke that privilege in the relevant security settings first, then return to the app page. Menu names vary by manufacturer and Android release.
- Protect accounts from a safer device. Change the Google-account password and other important passwords from a device the suspected person cannot access. Review signed-in devices, recovery email addresses, phone numbers and two-factor-authentication methods. Changing credentials on the monitored phone can reveal the plan, so timing matters.
- Recheck after the change. Run the scanner again, review new app installations and watch for repeated permission prompts or unfamiliar account activity. A second clean scan still cannot rule out every form of monitoring.
Is Google Play Protect enough to find spyware?
Play Protect is useful as a built-in first check, but the September 2025 AV-Comparatives test found it detected 53% of the commercial stalkerware samples. That leaves a large gap compared with the 100% result recorded by Malwarebytes Mobile Security and the 94% results from four other products in the same test.
Keep Play Protect enabled even if you add another scanner, because it checks apps distributed through Google’s ecosystem and can warn about some harmful packages. Do not interpret an “all clear” message as proof that no person can monitor the phone through an account, a modified app or a sample outside the test.
Which Android scanner should I choose?
Start with the reason for scanning, then weigh detection against safety and usability. The highest percentage is valuable, but it is not the only criterion.
If maximum tested detection is your priority
Malwarebytes Mobile Security led the cited test with 100% detection. That is the strongest measured result in this particular benchmark, not a guarantee against future samples.
If you want several products tied near the top
Bitdefender Mobile Security, ESET Mobile Security, Kaspersky Mobile Security and McAfee Mobile Security each recorded 94%. Kaspersky’s test installation came from the vendor’s website because it was not available on Google Play at that time, so verify the current distribution method and authenticity before installing.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If you are considering a lower-scoring option
Avast Mobile Security, Avira Antivirus Security and F-Secure Total Security recorded 88%; Norton 360 Mobile Security and Sophos Intercept X for Mobile were reported at about 82%; G DATA Mobile Security reached 65%; and Trend Micro Mobile Security reached 59%. These results do not make a product unusable, but they provide less evidence of coverage against the tested samples than the leading group.
If you prefer not to install another app
Use Play Protect and a careful manual review, understanding that its 53% result in the cited test was materially below the leading products. This route may be reasonable for a routine check when there is no specific safety concern, but a suspected stalking situation deserves a more deliberate plan and, where safe, an additional independent scanner.
What features matter beyond the test score?
Use these questions when comparing current versions or deciding whether to keep a scanner installed:
- What exactly was tested? Look for a named independent test, its date, the Android setup and the sample set. A product page’s undated detection claim is harder to interpret.
- Does it scan the whole device? An installed-app-only check may not inspect downloads, configuration changes or other relevant areas. Confirm the scope in the product’s current documentation.
- Does it monitor new installations? Real-time warnings can catch a suspicious app sooner than a weekly manual scan, although they may also create visible notifications.
- Can it resist interference? Commercial stalkerware may try to disable or confuse security software. The 2025 test included samples that interfered with products, making tamper resistance a practical concern.
- Are warnings understandable? “Stalkerware” or a plain-language explanation is more actionable than a generic threat label, especially for someone deciding whether removal is safe.
- Can you control removal timing? A tool that forces immediate deletion may be dangerous in an abuse situation. Look for a review or quarantine step before uninstalling.
- What happens to your data? Read the privacy policy, permission requests, update history and support options. A security app should not require access unrelated to its stated protective function.
- Which platforms are covered? If the suspected monitoring also involves a computer, tablet or account, Android-only scanning will not cover those systems. Keep the scope of the check explicit.
What are the main failure modes when removing spyware?
The scanner finds nothing
A negative result may mean the sample was outside the test set, was modified, was newly released or operates through an account rather than a visible app. Review account sessions and permissions from a safer device, and seek specialist help instead of repeatedly installing random “spy detector” apps.
The alert is generic
Save the exact wording and app identity if it is safe. Generic labels do not establish who installed an app or whether it is stalkerware; investigate the app’s publisher, permissions and purpose before removal.
The app cannot be uninstalled
Some apps use administrator or other management privileges. Do not keep tapping through settings if that could alert someone. An advocate or qualified technician can help plan a safe sequence, and a factory reset should be considered only after account, evidence and safety implications are understood.
Free tools Windows power users keep installed
One-click scans. No signup required.
The phone behaves normally after removal
Normal behavior does not prove that monitoring ended. Change credentials, review signed-in devices and check other devices or accounts that could still expose location or messages. Continue monitoring for unexplained permission changes or new installations.
Removing the app destroys evidence
If legal proceedings or a protection order may be relevant, ask an advocate or law-enforcement digital-evidence specialist about documentation before uninstalling. Preserve only what is safe to store; screenshots or exported logs can themselves be discovered by an abusive person.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What does the law say about covert monitoring?
Laws vary by country and state, but installing software on another person’s phone without informed permission can carry serious privacy and criminal consequences. The FTC’s SpyFone enforcement illustrates that regulators may seek bans, data deletion and other remedies against operators of covert-surveillance services. The December 2025 decision leaving that order in place reinforces that covert monitoring is not a harmless consumer use case.
Do not use a security scanner to inspect another person’s phone without consent, even if you are a parent, partner, employer or device administrator. For legitimate management, use a transparent policy, documented permission and tools intended for that role.
Recommended Free Tools
What is the practical verdict?
For an Android phone that can be checked safely, Malwarebytes Mobile Security is the strongest choice in the cited September 2025 benchmark at 100% detection. Bitdefender, ESET, Kaspersky and McAfee followed at 94%, while Play Protect alone reached 53%. Choose based on the dated test result plus alert clarity, scan scope, tamper resistance, privacy and the ability to delay removal.
Most importantly, treat safety planning as part of spyware detection. A scan can miss threats, and an immediate uninstall can expose someone to retaliation. Use a safer device and an advocate when abuse is possible, then secure accounts and review the phone only when the timing will not increase danger.
Frequently Asked Questions
Can I scan a phone without the person who installed the spyware knowing?
There is no reliable way to guarantee secrecy. A scanner, a notification, a permission change or a sudden loss of data can reveal that the phone was checked, so use a safer device for planning and ask an advocate about timing before scanning.
Should I factory-reset an Android phone after finding stalkerware?
A reset can affect evidence, account access and personal safety, and it may not address a compromised online account. Get specialist or advocate guidance first, back up only what is safe, and secure accounts from a trusted device.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Why do two security apps disagree about the same Android app?
Products use different detection rules, sample coverage and alert wording. One may classify an app as a generic potentially unwanted program while another names stalkerware, so compare the exact alert, permissions and publisher rather than assuming one result proves the other wrong.
Can spyware still monitor me after I change my Google password?
Password changes protect the account but do not remove a malicious app or other device access by themselves. Review signed-in devices, recovery methods and app permissions, and make changes from a device the suspected person cannot access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
