97 Things Every Information Security Professional Should Know

Chapter 55. Stalkerware: When Malware and Domestic Abuse Coincide

Martijn Grooten

Stalkerware, also sometimes called “spouseware,” is defined by the Coalition Against Stalkerware as software, made available directly to individuals, that enables a remote user to monitor the activities on another user’s device without that user’s consent and without explicit, persistent notification to that user in a manner that may facilitate intimate partner surveillance, harassment, abuse, stalking, and/or violence.

Stalkerware is functionally similar to spyware. One important difference though is that it is typically installed manually by someone with (temporary) access to a device, whereas ordinary spyware, like most malware, is installed remotely, either through an exploit or through social engineering. This means stalkerware doesn’t need to try hard to bypass security restrictions as they could be turned off during the manual installation process.

From a traditional digital security point of view, stalkerware seems easy to defend against. After all, you wouldn’t give a cybercriminal or a nation state actor access to your phone. But these aren’t the kind of actors using stalkerware: the typical person using stalkerware is an abusive partner or ex-partner. They often have such access or can obtain it through force or social engineering.

This main use of stalkerware is not what vendors want ...