Phishing, Stalkerware, and Mercenary Spyware Triage

Phishing, stalkerware, and mercenary spyware require different checks. A suspicious message is evidence about a possible account attack. A hidden monitoring app points to device access. A high-confidence platform threat notification points to targeted mercenary activity. Treating all three as a single "spyware app" problem can destroy evidence or miss the actual entry point. Google phishing guidance, retrieved 10 August 2026; FTC SpyFone complaint, retrieved 10 August 2026; Apple threat-notification guidance, retrieved 10 August 2026.

1. Suspicious message or phishing

Check the actual sender address, the destination behind a link, requests for passwords or financial data, and unexpected attachments. Do not click or download from an untrusted message. Open the service through its official app or a known address instead. Google's phishing indicators and response steps, retrieved 10 August 2026.

A phishing message is not proof that spyware is installed. It is a reason to review account activity, report the message, and secure the account through the provider's official surface. Google phishing guidance, retrieved 10 August 2026.

2. Stalkerware after device access

The FTC's SpyFone complaint documents one concrete installation pattern: the purchaser needed physical access, downloaded the app outside Google Play, bypassed operating-system restrictions, disabled app verification, and hid the app under the name "System Service." After installation, monitoring continued remotely. This is evidence about SpyFone, not a claim that every stalkerware product works identically. FTC complaint paragraphs 6-9, retrieved 10 August 2026.

If someone with physical access knew the passcode or controlled shared accounts, use a safe device to inventory account sessions, discuss evidence preservation, and plan any removal. The Coalition Against Stalkerware warns that monitoring can extend beyond a single app and that significant changes may escalate abuse. Survivor detection, removal, and prevention guidance, retrieved 10 August 2026.

3. Mercenary spyware and threat notifications

Citizen Lab forensically linked two journalists' cases to Paragon's Graphite spyware. It identified an iMessage zero-click attack, and Apple told the researchers that the exploited issue was mitigated as of iOS 18.3.1 and assigned CVE-2025-43200. Citizen Lab forensic report, retrieved 10 August 2026.

Apple describes its threat notifications as high-confidence alerts for individually targeted mercenary-spyware activity. A real notification is visible after signing in directly at account.apple.com and does not ask the recipient to click a link, install a profile, or disclose a password. Apple recommends expert help and lists Lockdown Mode among its protective steps. Apple threat-notification guidance, retrieved 10 August 2026.

Triage by evidence

• Only a suspicious message: do not use its link; verify through the provider and review account activity. Source, retrieved 10 August 2026.
• Possible intimate-partner monitoring: use a safe device and make a safety plan before removal or reset. Source, retrieved 10 August 2026.
• Apple threat notification: verify at account.apple.com, update devices, follow the alert, and contact an expert response service. Source, retrieved 10 August 2026.
• Known Graphite exposure: preserve the notification and seek forensic help; visible apps are not a reliable test for the documented zero-click route. Source, retrieved 10 August 2026.

Sources

• Google phishing guidance, retrieved 10 August 2026.
• FTC complaint against SpyFone, retrieved 10 August 2026.
• Coalition Against Stalkerware survivor guidance, retrieved 10 August 2026.
• Citizen Lab Graphite forensic report, retrieved 10 August 2026.
• Apple threat-notification guidance, retrieved 10 August 2026.