Stalkerware is the dark side of commercial spyware – surveillance software deployed not by intelligence agencies, but by people close to the target. On the iPhone, this works differently than on Android devices, but it remains just as dangerous. What stalkerware actually is, how it gets onto the iPhone, and which concrete steps help when suspicion arises.
In Germany, stalkerware is a documented and growing problem. According to Kaspersky's annual "State of Stalkerware" report, Germany has been the most affected country in Europe for years – in 2023 with 577 recorded victims, ahead of France, the United Kingdom, Spain, and Italy. An accompanying Kaspersky survey shows: One in three people in Germany has already had experiences with digital stalking. Behind these numbers there are no state-sponsored hacking groups and no intelligence agencies, but almost always people from the direct surroundings of those affected: ex-partners, family members, intrusive acquaintances. The smartphone becomes a tool of control, blackmail, and pursuit – and the iPhone is no exception, even though Apple significantly limits the stalkerware market through its closed platform. Anyone who knows the mechanisms by which stalkerware reaches the iPhone can deliberately look for traces and initiate protective measures. The explainer on Pegasus and commercial spyware covered the state-actor side of this problem – stalkerware is the private variant, with its own entry routes and its own warning signs.
What Stalkerware Actually Is
Stalkerware refers to commercial surveillance software that is usually officially marketed as "parental control," "employee monitoring," or an "anti-theft solution," but in practice is primarily used to monitor the behavior of an adult without their knowledge. The market hosts numerous providers in this category, distributing their products via their own websites or by online subscription. They operate in a legal gray area – their products are technically available, but using them without the consent of the monitored person is punishable in Germany under section 238 of the Criminal Code (stalking) and, depending on the constellation, also under section 202a (unauthorized access to data).
Depending on the variant, the functions range from location tracking and reading along with messages and calls to activating the microphone and camera. The data is routed to a server operated by the provider and made available to the monitoring person through a web dashboard or a dedicated app. Anyone deploying stalkerware usually has to pay a monthly subscription – the market is large and well-established.
How Stalkerware Gets Onto the iPhone
Unlike on Android, iOS is so closed that no stalkerware can be loaded from the App Store – Apple's review process reliably filters out such apps. For the iPhone, there are therefore three realistic ways by which stalkerware actually reaches the device:
Apple Account credentials and iCloud synchronization: This is the most common path. Some providers sell a "no-jailbreak" variant that doesn't infect the iPhone itself but taps into the victim's Apple Account. Anyone who knows the victim's password and ideally their 2FA code can access iCloud backups, photos, messages, contacts, notes, and location data without ever having the device in hand. Prerequisite: Two-factor authentication can be bypassed or is disabled. As soon as 2FA is active, this attack route generally fails, because Apple sends a confirmation to the victim's trusted devices on every login attempt from a new device.
Jailbreak-based spyware: The older, more technically invasive variant. Anyone with physical access to an unlocked iPhone who performs a jailbreak can subsequently install full-featured surveillance apps from the gray market. These apps run hidden in the background, read along with messages directly, activate the microphone and camera, and transmit everything to an external server operated by the provider. On modern iPhones with current iOS, jailbreaking has become significantly more difficult – but it remains possible on older devices or outdated software.
Configuration profiles as a foothold: A configuration profile is the more inconspicuous variant. It's installed in seconds as soon as someone briefly has access to the unlocked iPhone, or the victim is tricked by a phishing email into confirming a profile. What this means in detail and how suspicious profiles can be tracked down is covered in depth by the dedicated guide on configuration profiles on the iPhone.
What all three paths have in common: They require either knowledge of the Apple Account password or brief physical access to the unlocked device. That's exactly the typical constellation in relationships, families, or shared living environments.
Warning Signs That Point to Stalkerware
Stalkerware is harder to detect on the iPhone than on Android, but it leaves traces. The following signals, taken individually, are not proof, but in combination they're a clear warning sign:
- The battery drains noticeably faster than usual without any change in usage
- The iPhone becomes noticeably warm even in standby
- Cellular or Wi-Fi data usage increases without any change in behavior
- Apps open with a delay, the system feels generally sluggish
- Unknown apps or configuration profiles appear in the settings
- The "Find My iPhone" feature has been unexpectedly disabled
- Location access for individual apps has been changed without any action of your own
- Notifications about unfamiliar logins to the Apple Account appear that you don't remember
- The Apple Account unexpectedly demands a new password
- Signs of an active jailbreak: apps like Cydia, Sileo, or Zebra that don't come from the App Store
- The warning signs of a hacked iPhone apply here as well and provide further indicators
Important: Apple's protective mechanisms can mask many of these traces. Anyone with a justified suspicion shouldn't wait for individual symptoms, but should go through the steps described in the next section directly.
Apple's Safety Check as the Central Tool
With iOS 16, Apple built in a dedicated workflow specifically for stalking and abuse scenarios: Safety Check. It's located under Settings > Privacy & Security > Safety Check and is the central lever for cutting all connections of a monitoring person to your own device and Apple Account in one go.
Safety Check offers two options:
Emergency Reset: The radical variant. It ends all sharing with other people in one go, disables app access to location, contacts, photos, and more, signs the device out of all linked Apple Accounts, and asks for an update of the Apple Account password. This variant is the right choice in acute danger – for instance when the monitoring person lives in the same household or when there's a suspicion of systematic data access.
"Manage Sharing & Access": The granular variant. Here you can review and decide person by person and app by app exactly which information is shared – location sharing, calendars, photo albums, reminders, health data. This option makes sense when only individual sharing arrangements should be cut, or when it's unclear what is being shared in the first place.
An important detail: In both modes, Apple offers the Quick Exit button in the upper right. With one tap, Safety Check is closed immediately and the iPhone jumps to the home screen – without any trace of which submenu you were last in. This is explicitly designed for situations in which the monitoring person suddenly enters the room. Changes made up to that point remain saved.
Running Safety Check
The steps for the security check in detail:
- Open Settings
- Tap Privacy & Security
- Scroll down and select Safety Check
- Choose between Emergency Reset or Manage Sharing & Access
- Go through the individual sections step by step
Safety Check guides you through five central areas, each of which is confirmed individually:
- People and shared information – which location sharing, calendars, photo albums, and health data go to whom
- Apps and permissions – which apps have access to location, contacts, microphone, camera, photos, and more
- Devices on the Apple Account – which iPhones, iPads, Macs, and Apple Watches are linked to your Apple Account
- Trusted phone numbers – which numbers the 2FA codes are sent to
- Apple Account password and emergency contacts – the option to change the password immediately and set emergency contacts
On iPhones running iOS 17 or later, Safety Check can additionally remove synced computers and activate Apple's iCloud Private Relay, provided an iCloud+ membership exists.
Additional Steps When Stalkerware Is Suspected
Safety Check is a central tool, but when a concrete stalkerware suspicion is at hand, it doesn't replace all further steps. The following make sense in addition:
Fully re-secure the Apple Account. Change the password, end all existing sessions, set up 2FA from scratch, and go through trusted phone numbers and emergency contacts completely. With a justified suspicion of long-term access, it's also worth taking a look at saved email aliases and recovery options.
Check configuration profiles. Under Settings > General > VPN & Device Management. Remove all unknown profiles – when in doubt, better delete one too many.
Check for jailbreak traces. Use the search function (swipe down on the home screen) to look for typical jailbreak app names such as Cydia, Sileo, or Zebra. If such apps are found, a jailbreak is likely – in that case, only a full factory reset helps.
Rethink the backup strategy. Anyone using iCloud backups should review what data is stored there and whether Advanced Data Protection for iCloud is active. Even with suspicious access to the Apple Account, existing iCloud backups are not automatically deleted.
Factory reset without backup restoration. If stalkerware is confirmed or highly likely, only a full reset of the iPhone helps. Important: The backup the device previously pulled data from may already be compromised. In that case, it's better to set the device up as a new iPhone instead of restoring from an old backup.
Regular Apple security updates and Stolen Device Protection already close many attack paths preventively. Both features are part of the basic equipment of any iPhone security strategy.
What Apple's Protection Mechanisms Don't Cover
For all the effectiveness of Safety Check, there are limits that are important to know:
- Apple doesn't provide a stalkerware scanner. Unlike on Android, there's no official Apple feature that explicitly searches for spy apps or iCloud access by stalkerware.
- There are no access logs for the Apple Account. Anyone using stalkerware via iCloud sync leaves traces on the linked devices, but not in a detailed login log that could be reviewed in depth.
- A successful Safety Check doesn't prevent the monitoring person from attempting access again. Anyone living in the same household or knowing the password can start the process from scratch. Safety Check is a reset, not a permanent barrier.
In particularly serious cases – separations involving violence, domestic abuse, acute threat situations – no technical solution replaces going to the police and to specialized counseling services. The German nationwide Violence Against Women Helpline is reachable around the clock at the short number 116 016 – anonymous, free of charge, multilingual, and barrier-free. The Victim Hotline of Weisser Ring at 116 006 offers free counseling daily from 7 a.m. to 10 p.m. on all consequences of crimes. In case of acute danger, 110 is the police emergency number.
Detecting Stalkerware on the iPhone – the Key Points at a Glance
Stalkerware is the silent tool of a form of intrusion that takes place much closer to one's own life than most people assume. On the iPhone, it reaches the device via three routes: through compromised Apple Account credentials, through a jailbreak after physical access, or through configuration profiles. Anyone with a suspicion should immediately run Apple's Safety Check, review configuration profiles, change the Apple Account password, and set up 2FA from scratch. Apple's protection mechanisms help significantly here – but they're no substitute for professional help in acute cases. Anyone facing a threat from within their family or partnership has a right to support – technically as well as personally.
Time for fresh accessories? Visit our Amazon Storefront and discover a wide selection of products from leading manufacturers, including HomeKit accessories! (Image: Shutterstock / your)
- iMessage contact key verification explained
- Installing iOS 27 Public Beta: Instructions, risks and troubleshooting
- Disable Apple Intelligence: How to turn off the AI
- Apple Notes: Record audio and convert it to text
- Apple Intelligence and Data Privacy: How Apple Protects Your Data
- Create iPhone ringtones – without GarageBand
- Create Genmoji: Custom emojis with Apple Intelligence
- Image Playground: Create unique images on your iPhone
- „"Where is it?": Find lost Apple devices, AirTags and objects
- Apple Intelligence: Multiple languages possible?
- Using Apple Intelligence with Siri: Features and iOS 27 Outlook
- Visual Intelligence explained: How to use your camera and screen
Frequently Asked Questions: Stalkerware on the iPhone
Spyware like Pegasus is deployed by state actors or intelligence agencies and costs several hundred thousand euros per target. Stalkerware is the commercial variant – cancelable monthly, available online, deployed almost always by people from the direct surroundings of those affected. The two categories overlap technically but differ in reach and target group.
Yes, but only via one route: Some providers offer a "no-jailbreak" variant that runs exclusively through compromised Apple Account credentials – without access to the device itself. As soon as two-factor authentication is active, this route generally fails, because every new login requires a confirmation.
Against the iCloud-based variant, in most cases yes – provided no one has parallel access to the trusted devices or phone numbers. Against jailbreak-based spyware and configuration profiles installed after physical access, 2FA does not protect.
A feature built in since iOS 16, under Settings > Privacy & Security > Safety Check. It allows you, in a centralized workflow, to cut all sharing with other people and apps, change the Apple Account password, remove linked devices, and reset trusted phone numbers. With the "Quick Exit" button, the process can be left immediately at any time.
The Violence Against Women Helpline is reachable around the clock at 116 016 – anonymous, free of charge, multilingual. The Victim Hotline of Weisser Ring (116 006) offers free counseling daily from 7 a.m. to 10 p.m. on all consequences of crimes. In case of acute danger, 110 dials the police.
For jailbreak-based spyware, yes – a full factory reset removes the jailbreak and with it the spyware. Important: Don't restore the old iCloud backup, since it may already contain compromised data. For iCloud-based stalkerware, a reset isn't enough – here, the Apple Account additionally has to be re-secured.
Yes. Installing surveillance software without the consent of the monitored person fulfills, depending on the constellation, the offense of stalking under section 238 of the Criminal Code and unauthorized access to data under section 202a. Both are criminal offenses that can be reported to the police.
