Spyware on a smartphone, the signs of infection and forensic evidence for court

On Vikend popodne on Televizija E we talked about spyware on smartphones: how it gets onto a device, who uses it, how to recognise the signs of infection and how to gather evidence for court. We also covered privacy in ChatGPT and three habits that protect a phone.

Three methods of infiltrating a phone

Technology is moving so fast that even IT professionals struggle to keep up, so I would not necessarily blame the average user. Spyware is any add-on to an iPhone or Android operating system that uses the microphone or camera, records the screen or exports photos, documents, emails and messages, and there are three main methods of installing it.

Physical access is the easiest. Recently in the region, journalists targeted by security agencies had spyware installed while their phones were taken during questioning, and it was later proven that they had been under surveillance. The well-known Pegasus spyware targeted a large number of EU officials.

The one-click method is even more frightening, because it works remotely. A malicious link arrives through Viber, WhatsApp or iMessage, and opening it downloads a file that installs the spyware, or exploits a browser vulnerability to download it automatically.

The zero-click method is the most frightening, because it needs no action from you at all. The spyware gets in through a call alone, so you see only a missed call or a screen that lights up for a moment, and if you miss it, you have no idea anyone tried to get into your device.

Four kinds of users, from security agencies to parents

Security agencies use spyware in their regular work, when they need to secretly monitor people of security interest. The tool itself is neutral, and the problem starts when it is used unlawfully. Companies use it for corporate espionage, and some people buy commercial spyware to monitor a partner, usually to prove infidelity, instead of hiring a private detective.

The fourth category is entirely acceptable and works on the same principle. Parents use parental control software to limit which content and apps their children can use and to monitor how much time they spend in them.

Overheating, a draining battery and unfamiliar apps

Spyware is demanding: it runs many processes, uses the camera and microphone and sends data to a remote server, so the phone often overheats, the battery drains faster and the device slows down, just like an infected computer. An app you do not recognise can also be a sign, because commercial spyware usually presents itself under another name.

Sometimes it stays invisible, and for that there are tools such as the Mobile Verification Toolkit, or MVT, which is completely free and which anyone can run without prior knowledge by following the instructions online.

Black markets, mass surveillance and legal protection

Cybercriminals get spyware on dark web black markets, where practically anything illegal is on offer. It is also sold freely to state security agencies on the grounds that they may use it legally, but that often slips out of control. We have seen this recently in the region and in many EU countries, and in America Snowden alerted the public that such software was used for mass surveillance of citizens under the pretext of fighting terrorism, which is very alarming.

Our legal tools are limited, but you can seek legal help if there is reasonable suspicion backed by forensic evidence. If you suspect spyware on your device, get help from a forensic expert so that the evidence holds up in court, because otherwise it comes down to one person’s word against another’s. Forensic analysis can show where the software came from, how long it was on the device and what data it could collect, and even where that data was sent, which can lead to whoever is behind it.

ChatGPT privacy settings and three habits that protect a phone

ChatGPT’s advanced voices are fun to use, but think about where all that data goes. ChatGPT has an option that stops OpenAI from using your data to train its AI models, and you can delete your entire conversation history. I encourage everyone to explore the security and privacy settings in the apps they use.

Three things you can do today

• —Update the operating system and apps, because spyware usually exploits vulnerabilities in outdated versions that have since been patched.
• —Use two-factor authentication on every account, or at least on the important ones with sensitive data or messages.
• —Keep your phone with you, so that it does not end up in the wrong hands.

• Cybersecurity, children online and Skenify’s road to first place at AIM 2026RTV Herceg Novi
• Leaving Montenegro, lessons from abroad and coming home as an entrepreneurRTV Budva
• Online privacy, account theft, AI scams and what to do when you are targetedUdruženje za odgovorni i održivi razvoj
• The road to Secfix, Skenify’s pivot and leading startups with calm and transparencyScale SEE Podcast