How to detect and remove spyware on iPhone

Some people believe their iPhones are impenetrable mobile fortresses, but spyware can still find its way in. A Wired report exposed how advanced spyware infiltrates iPhones, bypassing Apple’s security features. Below, we’ll show you how to detect and remove spyware from your device, and explain why iPhones aren’t immune to this invasive type of malware.

Signs your iPhone is infected with spyware

Unusual performance issues, unexpected messages, or unfamiliar changes to your phone’s settings can all indicate that your iPhone has been infected with spyware. Watch out for the following signs of spyware on your iPhone.

• Rapid battery drain: Spyware runs in the background, constantly collecting and transmitting data, which can quickly drain your battery.
• Overheating: Malicious software overworks your device, causing your iPhone to overheat even when you’re not using it.
• Unusually high data usage: Spyware sends stolen data to external servers, often causing unexplained spikes in your data consumption.
• Slow performance: Spyware clogs up your system resources, slowing down your iPhone or causing it to crash.
• Random pop-ups: Unexpected ads or prompts can signal adware or spyware.
• Unfamiliar apps: Some spyware hides inside fake, duplicate, or unfamiliar apps that pose as legitimate tools.
• Unusual text messages: Spyware may send or receive messages to communicate with a remote server.
• Strange behaviour: Watch for random restarts, setting changes, or your mic and camera turning on without warning.
• Unknown device profiles: Hackers can install malicious profiles to control your phone.
• Your device connects to strange networks: Spyware often links to external servers. Use dedicated apps to spot suspicious network activity.

How to remove spyware from your iPhone

To remove spyware from your iPhone, run a malware scan, disconnect from the internet, delete suspicious apps or profiles, and secure your settings by revoking permissions. If the problem persists, you may have to reset your device for a clean start.

Here’s a closer look at the steps involved in deleting iPhone spyware.

Run a spyware scan

The easiest way to deal with spyware is to run a spyware scan. These are security checks that detect and remove malicious software from your phone.

The Norton spyware scanner relies on regularly updated threat databases that catch new spyware strains. It can run automatically or on demand to help you detect and remove threats quickly and safely.

To run a spyware scan with Norton Mobile Security for iPhone, simply install the app, enter Safe Mode, and start the scan.

Disconnect from the internet

You can also attempt to deal with spyware manually. To do so, start by disconnecting from the internet. This prevents spyware from sending your data to attackers.

To disconnect from the internet on an iPhone, open Settings and switch on Airplane Mode, or turn off Wi-Fi and Cellular Data until you’re finished with all the spyware removal steps.

Delete suspicious apps

Spyware sometimes hides inside apps you didn’t install or recognise. These apps may have gotten on your phone through phishing links, fake app stores, or by exploiting security gaps. Removing these apps cuts off spyware’s access and helps secure your iPhone.

To delete an app, press and hold its icon on your home screen, then select Delete App to uninstall it.

Revoke app permissions, reset privacy settings

Spyware can exploit app permissions, like access to your camera, microphone, or location, to spy on you. Revoking these permissions and resetting your privacy settings helps cut off spyware’s access and limits what apps can do.

To do this on your iPhone, go to Settings, then Privacy, and review each category. Disable permissions for any apps you don’t fully trust.

Update iOS to patch vulnerabilities

Once you’ve deleted odd apps and reviewed permissions, reconnect to the internet to update your phone’s operating system. This installs the latest security patches that could fix weaknesses that spyware and other malware can exploit. Keeping your software up to date helps block new threats before they can infect your device.

To update it, go to Settings > General > Software Update > tap Update Now if an update is available.

Restore your browser

Spyware can reinfect your device by modifying your browser. Clear your cache to help get rid of any harmful spyware remnants.

To clear your cache and cookies on your iPhone, navigate to Settings > Apps > Safari (or the browser you usually use). Scroll down and tap Clear History and Website Data > All history > Clear History.

Perform a full device reset

As a last resort, a full device reset wipes your iPhone completely, removing any spyware hidden in the system or apps. This step is the most reliable way to eliminate malware that other methods might miss — but it requires you to delete everything on your iPhone.

Before you reset, back up the data you want to save. But keep in mind that restoring from a backup that contains spyware could reinstall the infection. To reduce this risk, back up only essential files like photos and contacts using iCloud or another secure method. Avoid full-device backups if you suspect spyware is deeply embedded.

To reset your iPhone, go to Settings > General > Transfer or Reset iPhone > Erase All Content and Settings, then follow the on-screen prompts to complete the process.

How spyware gets on your iPhone

Cybercriminals use numerous social engineering methods, like phishing links or spoofed websites, to trick you into downloading malware. Here are a few common ways spyware can get onto your iPhone.

• Malicious apps: Some bad apps host spyware. They slip past App Store checks or come from unofficial sources, then secretly collect your data.
• Phishing links: Clicking malicious links in spam texts, emails, or social media messages can install spyware or direct you to harmful sites designed to steal your info.
• Spoofed websites: Visiting fake or compromised websites can trigger spyware downloads.
• Malvertisements: Malicious ads served through ad networks can redirect you to spyware downloads or exploit browser vulnerabilities to install malware.
• Jailbreaking: Removing Apple’s built-in security restrictions (jailbreaking) makes your device vulnerable, allowing spyware to install more easily.
• Physical access: Someone with direct access to your iPhone could install spyware manually or change settings to monitor you without your knowledge.

Common types of iPhone spyware

iPhone spyware could include commercial tools like Pegasus, stalkerware used for monitoring, keyloggers that record your typing, fake utility or tracking apps disguised as helpful tools, or malicious configuration profiles that give attackers control over your phone.

Here’s a closer look at the malware that could be tracking your every swipe.

• Commercial spyware: Private companies have created commercial spyware that is primarily sold to governments. One example is Pegasus, made by the Israeli company NSO Group, which can secretly access an iPhone’s data and control its features. Although designed for fighting crime, this type of spyware has raised privacy and human rights concerns.
• Stalkerware: Stalkerware is software used to secretly monitor and control someone’s phone, often by abusers who wish to track victims without their knowledge. A recent data breach revealed Catwatchful, a stalkerware app disguised as a child monitoring tool, had exposed the private phone data of nearly 26,000 people.
• Keyloggers: Keyloggers record everything you type, stealing sensitive info like passwords.
• Fake utility apps: Fake utility apps disguise themselves as tools like file managers or software updaters to trick users into installing spyware.
• Configuration profile abuse: Configuration profile abuse happens when spyware installs malicious profiles on your iPhone to gain control over settings and data. These profiles can grant attackers access to network traffic, app permissions, and more without your knowledge.

How to protect your iPhone from spyware

To help protect your iPhone from spyware, avoid risky actions like jailbreaking. Only download apps from trusted sources, keep your software updated, and use cybersecurity tools like antivirus software and VPNs.

Here’s a closer look at how you can protect your iPhone from spyware.

• Don’t jailbreak your phone: Jailbreaking removes Apple’s built-in protections, making your iPhone more vulnerable to spyware and other malware.
• Only download apps from the App Store: The App Store screens apps for security reasons, reducing the risk of installing malicious software.
• Watch out for phishing links: Avoid clicking links from unanticipated or suspicious messages to help prevent spyware infections.
• Use antivirus software: Antivirus software, like Norton Mobile Security for iOS, can help detect and remove spyware before it harms your device.
• Regularly update iOS: iPhone updates patch security flaws that spyware can exploit to access your phone.
• Enable two-factor authentication: 2FA and MFA (multi-factor authentication) add extra verification steps to protect your accounts even if passwords are compromised.
• Review app permissions regularly: Check which apps have access to sensitive data and revoke unnecessary permissions.
• Use a VPN: A VPN encrypts your internet connection, making it harder for attackers to read your in-transit data.
• Protect your phone from unauthorised access: Set a strong passcode and enable features like Face ID or Touch ID. This prevents anyone from unlocking your phone and accessing your private data without permission.

Protect your iPhone with Norton

Taking a few proactive steps can help keep your phone secure from spyware. Norton Mobile Security for iOS includes AI-powered protection that defends against scams, malware, and spyware, helping you stay one step ahead of cybercriminals.

Install Norton to help protect your device, reduce your risk of spyware infection, and keep your personal information safer.

FAQs

Why is it difficult to manually remove sophisticated spyware from iPhones?

Sophisticated spyware, like Pegasus, hides deep in your iPhone and can disguise itself, making it hard to find and remove manually. Without specialised tools, it’s difficult to fully get rid of it and keep your data safe.

How do government-grade spyware tools like Pegasus infect iPhones covertly?

Government-grade spyware like Pegasus infects iPhones covertly by exploiting hidden security flaws called zero-click exploits, which don’t require any action from the user. They can also spread through phishing links or malicious apps, allowing the spyware to install silently and gather data without detection.

What steps should I take to protect my privacy if I suspect my phone has a spyware infection?

If you suspect spyware, immediately disconnect from the internet, run a spyware scan with trusted software, delete suspicious apps, and update your iOS. Then, review app permissions and reset privacy settings. If issues persist, perform a full device reset after backing up essential data.

Are there iPhone codes to check for spyware?

There are dial codes that can help you identify suspicious call or message forwarding settings that may indicate unauthorised access. For example, *#21# shows whether calls or texts are being forwarded, and ##002# can disable call forwarding on many networks. However, these codes don't detect spyware on your iPhone themselves.

What app can detect spyware on iPhone?

Norton Mobile Security can help detect and remove spyware on iPhones. It also provides protection against other types of malware and scams.