What spyware does and why it matters on iPhone
Spyware is software installed on your phone without your knowledge that watches what you do — reading your messages, tracking your location, recording calls, or capturing what you type. On iPhone, spyware is less common than on Android because Apple controls what can be installed more tightly, but it still happens, usually through a malicious link you tap, a fake app, or physical access to your phone by someone who knows your passcode.
The difference between spyware and a normal app is consent and visibility. A weather app you downloaded knows your location because you gave it permission and you can see it running. Spyware hides itself — you did not knowingly install it, it does not show up in your app list the way normal apps do, and it works in the background without your knowledge.
If someone has installed spyware on your phone, they can see your messages before you delete them, know where you are in real time, or intercept passwords you type. The most common reason this happens is someone close to you — a partner, family member, or employer — rather than a random hacker.
Key Takeaways
- Spyware on iPhone usually gets in through a link you tap, a fake app, or someone with your passcode installing it while they have physical access.
- Battery draining faster than normal, data usage spikes, and your phone getting hot are the most reliable signs something is running in the background.
- Check your installed apps against what you remember downloading — spyware sometimes hides under a generic name or disguises itself as a system app.
- If you find spyware, the safest fix is to back up your data through iCloud, then erase your phone and restore from that backup.
- Spyware that runs through your Wi-Fi network or uses a jailbreak is harder to spot because it does not show up as an installed app at all.
Battery drain and data usage as warning signs
The most obvious sign that spyware is running on your iPhone is battery draining much faster than it used to, even when you are not actively using the phone. Spyware runs constantly in the background — uploading location data, recording audio, or syncing messages — which burns battery even while your screen is off. If your battery goes from 100 percent to 20 percent in a few hours of light use, something is consuming power in the background.
Check your battery usage by opening Settings, then Battery, then Battery Health & Charging. Scroll down to see which apps have used the most battery in the last 24 hours or the last 10 days. If you see an app you do not recognize, or if an app you barely use is at the top of the list, that is worth investigating. Spyware often shows up as a system process with a generic name like "System Services" or "Bluetooth" to blend in.
Data usage spikes are another red flag. Open Settings, then Cellular, and scroll down to see which apps have used the most data. If an app you never use is consuming gigabytes of data, or if your total data usage jumped without explanation, spyware uploading stolen information is a likely cause. Compare this month to last month — a sudden jump is more suspicious than a gradual increase.
Physical signs: heat, crashes, and strange behavior
If your iPhone feels hot to the touch when you are not using it, the processor is working hard on something. Spyware running in the background will make your phone warm even when the screen is off. This is different from normal heat — a phone that gets warm while you are actively using it is normal, but a phone that stays warm while sitting on your desk is not.
Apps crashing unexpectedly or your phone freezing for a few seconds at a time can mean spyware is consuming so much processing power that normal apps cannot run smoothly. You might also notice your phone taking longer to open apps, or the keyboard appearing slowly when you try to type. These are signs the processor is overloaded.
Strange behavior like your phone making sounds or vibrating when you are not touching it, or your screen turning on by itself, can indicate spyware is active. Some spyware also causes your phone to restart on its own or to lose connection to Wi-Fi and cellular networks repeatedly. If these things happen regularly, not just once in a while, investigate further.
How to check your installed apps
Open the App Store and tap the profile icon in the top right corner. Tap "Purchased" to see every app you have ever downloaded on this Apple ID. Scroll through the list and look for apps you do not remember installing. Spyware sometimes uses a generic name like "Settings," "System Update," "Photos," or "Utilities" to hide in plain sight, or it uses a name similar to a real app so you might miss it.
Pay special attention to apps with no icon visible on your home screen or in your app library. If you see an app in your Purchased list but cannot find it anywhere on your phone, that is suspicious — it may be hidden. Try searching for it in Spotlight (swipe down from the top of your home screen and type the app name). If it shows up in search but not in your app library, it is deliberately hidden.
Also check your Settings for apps with unusual permissions. Open Settings, scroll down, and tap each app to see what permissions it has requested. If a flashlight app is asking for access to your location, messages, or camera, that is a red flag. Spyware often requests broad permissions that seem unnecessary for what the app claims to do.
Checking for jailbreaks and network-based spyware
Some spyware does not install as an app at all — instead, it runs through a jailbreak, which is a modification that removes Apple's restrictions on what software can do. If your iPhone has been jailbroken, spyware can run at a deeper level and hide from normal detection. Check whether your phone is jailbroken by looking for an app called Cydia or Sileo on your home screen or in your app library. If either exists, your phone has been jailbroken.
You can also check by opening Safari and trying to visit cydia.saurik.com. If the page loads, your phone is jailbroken. A jailbreak is usually done by someone with physical access to your phone, so if you did not do it yourself, someone else did.
Network-based spyware is harder to detect because it intercepts your data as it travels across Wi-Fi rather than running on your phone itself. If you suspect this type of spyware, check which Wi-Fi networks your phone has connected to recently. Open Settings, then Wi-Fi, and look at the list of networks you have joined. If you see a network name you do not recognize, or a network with a name very similar to a legitimate one (like "Starbucks" vs. "Starbucks-Free"), someone may have set up a fake network to spy on you.
What to do if you find spyware
If you believe spyware is on your iPhone, the most reliable way to remove it completely is to erase your phone and restore it from a backup. This works because spyware cannot survive a full erase — it gets deleted along with everything else. However, if your backup itself is infected, you will restore the spyware when you restore from that backup.
To do this safely, first back up your data through iCloud. Open Settings, tap your name at the top, then iCloud, then iCloud Backup, and tap "Back Up Now." Wait for the backup to complete. Then go to Settings, General, iPhone Storage, and tap "iPhone Storage" again. Scroll down and tap "Erase iPhone." Choose "Erase All Content and Settings" and confirm. Your phone will restart and ask you to set it up as new.
When your phone restarts, set it up as a new iPhone rather than restoring from your backup when ready. This gives you a clean phone. Then, restore your data from the iCloud backup you just created. Open Settings, tap your name, then iCloud, then iCloud Backup, and choose "Restore from iCloud Backup." Select the backup you just made and wait for it to restore.
If you cannot erase your phone because you do not know the passcode, or if you believe someone with your passcode installed the spyware, contact Apple Support or visit an Apple Store. They can help you regain control of your phone. You may also want to change your Apple ID password from a different device before you do this, so whoever has access to your phone cannot lock you out.
How spyware gets onto iPhone in the first place
The most common way spyware reaches iPhone is through a link in a text message, email, or social media that you tap. The link might look like it goes to a legitimate website — a bank, a social network, a package delivery service — but it actually installs spyware. These links often come with a message designed to create urgency, like "Your account has been locked" or "Confirm your identity now."
Spyware can also arrive through a fake app downloaded from the App Store, though Apple reviews apps before they appear there and removes malicious ones when discovered. The risk is higher if you read apps from outside the App Store, such as through a web link or email attachment.
The third common route is physical access. If someone has your passcode or your face unlocks your phone, they can install spyware while you are not looking. This is why it matters who knows your passcode and whether you leave your phone unattended around people you do not fully trust.
Frequently Asked Questions
Can spyware on iPhone work without jailbreaking?
Yes. Spyware can run as a normal app if you tap a malicious link that installs it, or if someone with your passcode installs it while they have physical access. Jailbreaking allows spyware to run at a deeper level and hide more effectively, but it is not required for spyware to exist on your phone.
Will restarting my iPhone remove spyware?
Restarting will not remove spyware permanently, but it may temporarily stop it from running. Spyware is designed to restart itself when your phone turns back on. A full erase and restore is the only reliable way to remove it completely.
If I think someone is spying on me, should I tell them I know?
No. If you believe someone close to you installed spyware, telling them may cause them to become defensive or to install it again on a different device. Instead, erase your phone, change your passwords from a different device, and consider whether you feel safe around this person. If you are in danger, contact local authorities or a domestic violence hotline.
Can I remove spyware by deleting the app?
If the spyware is visible as a normal app in your app library, deleting it will remove it. However, some spyware hides itself or uses multiple apps to stay installed. If you delete one and the suspicious battery drain continues, other spyware may still be running. A full erase is more reliable.
Does Apple notify you if spyware is detected?
Apple does not send notifications about spyware. However, if you see a notification from Apple saying your phone is infected or asking you to read a security update outside of the normal Settings update process, that notification itself is likely spyware. Apple updates come through Settings only.