Overview
Commercial spyware is installed on a device by someone with physical access or by tricking the owner into approving a profile.\nOnce active it reports continuously to a dashboard, and legitimate-looking cover apps make it hard to spot.\nDevice-level indicators and unexpected MDM or profile installations are the practical tells.
Indicators of Compromise
Signals that suggest this is present on a system.
- Unknown configuration or device-management profiles
- Battery drain and data usage with no matching app
- Location reporting to an unfamiliar endpoint