Spyware is software installed on a device without meaningful consent. They monitor activity, collect data, and transmits it to a third party.
Spyware ranges from commercial stalkerware (marketed to monitor spouses) to state-grade tools like Pegasus, capable of compromising a device without the user clicking anything.
Key fact: spyware operates above the VPN layer. Once installed, encrypted communications provide no protection. Spyware reads content before it is encrypted and after it is decrypted. Device integrity matters more than communication security.
What it means in practice
Consumer spyware — mSpy, FlexiSpy, Hoverwatch — requires about five minutes of physical access to install on Android. On iOS, it often works through iCloud credentials alone, with no device access needed. It runs invisibly, survives basic resets, and transmits data to a dashboard accessible from any browser. Installing it without consent is illegal in most jurisdictions regardless of the relationship between the parties.
Related articles
How your spouse may be reading your messages. — 8 signs your phone is being monitored. — Digital privacy checklist before filing for divorce. — Assume your devices are already compromised.