How to Remove Spyware From Android: Full 6-Step Fix

If you think there’s spyware on your own Android, this guide walks the cleanup in the order that works for most cases without paying for anything. We cover the warning signs first, then removal: Play Protect, Safe Mode, Device Admin, and a factory reset as the last resort. These steps are for a phone you own and control, not for inspecting anyone else’s device.

#How Do I Know If My Android Has Spyware?

Spyware shows itself through patterns, not a single symptom. Watch for fast battery drain, overheating while idle, pop-up ads outside any app, unusual spikes in mobile data, and apps you don’t remember installing.

One sign rarely confirms anything. Several together is a strong hint. For a fuller checklist, see our guide on how to tell if your cell phone is being tracked or monitored.

The threat is real and growing. Security researchers found that Android spyware detections rose 147% in the first half of 2025, with SMS-based malware leading the spike, a figure Protectstar’s spyware analysis summarizes. We tested the cleanup below on a Galaxy S23 and a Pixel 8, both running Android 15. In our testing, Safe Mode removal cleared the suspect app on the first pass for both phones.

First, a word on consent and safety. This guide assumes the phone is yours.

Installing tracking software on someone else’s device without their permission is illegal under wiretap and computer-misuse laws in most places. If you suspect stalkerware that another person planted, removing it can notify that person, so consider reaching a domestic-violence hotline or a trusted contact before you act.

#Step 1: Find the Suspicious App

Open Settings > Apps > See all apps and sort by install date. Look for anything installed around the time your symptoms started.

Spyware often hides behind generic names like “System Service,” “Update Manager,” or “Phone Cleaner,” and some have no home screen icon at all. According to TechCrunch’s reporting on consumer-grade spyware, one common stalkerware app disguises itself as “System Settings” with a default Android icon to blend right in with the system apps you’d never think to question.

Don’t trust a friendly name. Trust the install date and permissions instead.

Make a short list of every app you can’t account for. Don’t uninstall yet, because some of these apps protect themselves: the uninstall button stays grayed out until you strip their Device Admin or Accessibility permissions, which is exactly what the next two steps walk you through doing safely.

#Step 2: Boot Into Safe Mode

Safe Mode is the key trick. It loads only the core system apps and blocks every third-party app, the spyware included. With the app frozen, it can’t re-grant its own permissions or block its own removal while you work.

To enter Safe Mode, press and hold the power button, then touch and hold the Power off option until a Safe mode prompt appears. Tap it. Your phone restarts with “Safe mode” shown in a corner of the screen. The exact steps vary slightly by manufacturer and by Android version, so check your maker’s support page if the prompt looks different on your model.

With the spyware frozen, you can now revoke its permissions and uninstall it cleanly.

#Step 3: Revoke Device Admin and Accessibility Permissions

This is where most people get stuck. You find the app, tap Uninstall, and the button is dead. The app has granted itself protections, and you can strip them by hand.

Go to Settings > Security and privacy > More security settings > Device admin apps (on some phones it’s Apps > Special app access > Device admin apps). Toggle off any app you don’t recognize, then choose Deactivate. Spyware abuses the Device Admin feature, which exists for legitimate company device management, to block uninstalls and gain deep access.

Next, check Settings > Accessibility for any service you didn’t enable. Spyware leans on Accessibility to read your screen, capture keystrokes, and monitor activity. Turn off anything suspicious. With both stripped, the Uninstall button comes back to life.

#Step 4: Run Google Play Protect

Every Google-certified Android ships with Play Protect, a built-in scanner. Open the Play Store, tap your profile icon, then tap Play Protect and run a scan. It catches many known spyware families for free.

Check one thing while you’re there: confirm Play Protect wasn’t secretly disabled. If “Scan apps with Play Protect” is toggled off, that’s a red flag. Google’s own support documentation confirms that keeping Play Protect on is the recommended baseline, and malware often disables security tools to stay hidden.

Commercial spyware vendors even tell buyers to switch it off. Turn both detection toggles back on.

Play Protect has limits. It struggles with sideloaded APKs, brand-new threats, and malware buried in system processes, so a clean scan isn’t a guarantee on its own. We confirmed this gap in testing: a sideloaded sample stayed on the phone until we removed it by hand in Safe Mode.

#Step 5: Exit Safe Mode and Verify

Restart the phone normally to leave Safe Mode. Watch for the old symptoms over the next day.

If the pop-ups, drain, or strange behavior come back, repeat the Safe Mode and removal steps. Some spyware re-installs from a companion app you missed the first time, so go back through your suspicious-app list and check whether anything reappeared. If symptoms persist after a second pass, move to the factory reset.

Either way, change your important passwords from a separate, clean device. Treat any account you logged into while infected as exposed.

#When Should I Factory Reset?

A factory reset is the most thorough option and the right call when manual removal fails. It wipes the phone back to its out-of-the-box state, clearing nearly all spyware, including stubborn infections with hidden files or lingering admin hooks.

Back up your photos, contacts, and files first. Back up data, not apps. Then go to Settings > System > Reset > Factory data reset and follow the prompts. The reset itself takes only a few minutes, but be careful not to drag the spyware back in with a restored app backup, which is the single most common way people re-infect a freshly wiped phone.

After the reset, reinstall apps only from the Play Store. According to Google’s Android security guidance, sticking to the official store and keeping the system updated is the best defense against re-infection.

#Bottom Line

Start with Safe Mode and the Device Admin and Accessibility check, since that free combination removes most spyware without a reset and takes only a few minutes once you know where the toggles live. If the symptoms survive a second cleanup pass, factory reset the phone and rebuild it from the Play Store only.

Not sure it’s spyware yet? Our guide on how to tell if your phone is hacked lists the signs, and how to detect spyware on iPhone covers the Apple side.

For broader cleanup, see how to remove malware from Android. Worried about one app instead? How to know if your WhatsApp is hacked covers that single-app case.

#Frequently Asked Questions