What is spyware?
Spyware is malware that collects information about a user, device or organization and sends it to someone else without consent. Its defining trait is covert collection: spyware wants to stay installed and unnoticed so the flow of information continues. Depending on the type, it can capture browsing history, form data, saved passwords, session cookies, documents, screenshots, keystrokes, messages, call logs and location.
Types of spyware
- Infostealers harvest saved browser passwords, cookies, autofill data and cryptocurrency wallets and send them to the attacker. Stolen session cookies can let an attacker reuse a signed-in session without the password.
- Keyloggers record what the user types; they are often counted as their own category.
- Tracking and monitoring software records browsing and activity for advertising or surveillance.
- Stalkerware is installed on a phone or computer by someone with physical access, often a partner or family member, to read messages, track location and listen to calls.
- Commercial mobile spyware sold to governments has been used against journalists and activists, sometimes through exploits that need no user interaction.
How spyware gets installed
Spyware commonly arrives bundled with free software, browser extensions, cracked applications or trojanized apps from unofficial stores. Some arrives as the payload of a phishing attachment or a trojan. Stalkerware is usually installed by hand on an unlocked device. On phones, monitoring apps tend to request broad permissions such as accessibility services, device administrator rights, location, microphone and SMS access.
Signs of spyware and how to remove it
Spyware is built to be quiet, so symptoms are indirect: unexpected outbound connections to unfamiliar hosts, unfamiliar processes or browser extensions, a phone with unusual battery drain or data use, apps with permissions they do not need, and accounts accessed from places the user has never been.
Removal starts with an updated anti-malware or EDR scan and a review of installed programs, extensions and app permissions. Because infostealers take credentials and cookies quickly, change passwords from a clean device and sign out all active sessions. On a phone with stalkerware, consider the safety of the person before removing it, because removal can alert whoever installed it.
Spyware vs. adware vs. keylogger
Separate them by intent. Spyware is about stealing information secretly. Adware is about showing advertising and is loud by design, with pop-ups, redirects and a changed home page. A keylogger records keystrokes and is often one component of a spyware or RAT payload. If a scenario stresses hidden data collection, choose spyware; if it stresses pop-ups, choose adware; if it is specifically about captured typing, choose keylogger.
Spyware on the CompTIA Security+ exam
Spyware is one of the malware types in SY0-801 objective 2.5. Scenario wording that points to it describes information leaving the device without the user's knowledge, such as credentials used elsewhere soon after installing a free tool, or a phone sharing location and messages. Distractors include adware, keylogger, RAT and PUP. Expect remediation answers built on anti-malware, permission review, removing the offending software and resetting stolen credentials. The term also appears in A+ Core 2 (220-1202) objective 2.4, which lists stalkerware as well.