Guide
Android Malware Stalkerware And Compromise
20 pages · 27 min read
Android's openness creates a larger threat surface, making sideloaded stalkerware and malware easier to install.
- Mobile and messaging evidence
- Cyber incidents and ransomware
§ Guide
Android Malware Stalkerware And Compromise
This guide explains how Android devices are compromised, what can be found, and the duty of care that comes first.
Ref · E-D · 2026 · §LIBClass · ConfidentialJuris · England & WalesStatus · Active
Guide · 20 pages · 27 min read · Published 2026-09-02
Android's open platform, while offering flexibility, presents a larger threat surface compared to iOS. This openness means that sideloaded stalkerware and malware are often easier to install, and sweeping permissions can grant these malicious applications extensive access to device data. However, this same openness also allows a digital forensic examiner to more thoroughly inspect applications and their permissions, aiding in the detection of compromise. The most common forms of surveillance on Android devices frequently involve consumer stalkerware installed with physical access, or the misuse of legitimate device features and shared accounts, rather than sophisticated malware. Understanding these mechanisms is crucial for legal practitioners.
This guide sets out to demystify the complexities of Android device compromise, outlining how such incidents occur and what indicators can be observed. It details the process of detecting compromise, emphasising that the safety of the individual must always take precedence over the preservation of evidence. The guide also explores the broader architecture where evidence might reside, beyond the device itself, including family sharing setups, Google accounts, and other connected services. Practical examples illustrate common scenarios, such as stalkerware identified by its permissions or "spyware" that is actually a misused shared Google account, providing concrete insights into real-world situations.
A practitioner can use this guide to better understand the vulnerabilities inherent in Android devices and the methods used for compromise. It provides a framework for identifying red flags, understanding technical limitations, and formulating pertinent questions to ask clients, opposing parties, or digital forensic providers. The guide also offers suggested wording for instructing an Android suspected-compromise analysis, ensuring that investigations are thorough and legally sound. By following the principles outlined, legal professionals can navigate the challenges of Android malware, stalkerware, and compromise with a victim-centred approach, protecting both the person and the integrity of the evidence.
Share
Read this guide on your phone, open the PDF reader with the full text, browse guides by topic or go back to the full PDF library.
§ Credit and source
Published by Computer Forensics Lab on 2026-09-02. Original material of the practice, free to read, cite and download. The authority behind this subject is NCSC incident management guidance, which you should read alongside this guide. See every guide's author and source.
§ Read Android Malware Stalkerware And Compromise
Download the PDFPrefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the current wording of the guide, including any later corrections.
Page 1
ANDROIDMALWARE & STALKERWARE · A GUIDE FOR UK LAWYERS Android Malware, Stalkerware and Compromise The Open Platform's Larger Threat Surface, What Can Be Found, and the Duty of Care That Comes First COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES ANDROID STALKERWARE & MALWARE DETECTION SAFET Y-LED, VICTIM-CENTRED APPROACH CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: openness cuts both ways 03 How Android devices are compromised 04 Detecting compromise: what Android lets you see 05 Safety first: the duty of care 06 Interpretation and honest limits 07 Deployment: protecting the person, then the evidence 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: Android's openness gives it a larger threat surface than iOS, sideloaded stalkerware and malware are easier to install and sweeping permissions let them see a great deal, but the most common surveillance is still consumer stalkerware installed with physical access or the misuse of legitimate features, openness also lets an examiner inspect apps and permissions more fully, and, as on iOS, the person's safety comes before the evidence.
§ 02 · FIRST PRINCIPLES The problem in plain English: openness cuts both ways
§ 03 · HOWDEVICESARECOMPROMISED How Android devices are compromised STALKERWARE PERMISSIONS MISUSED FEATURES CONTROLLED MALWARE (RARE) ACCOUNT
Page 2
§ 04 · DETECTINGCOMPROMISE Detecting compromise: what Android lets you see
§ 05 · SAFETYFIRST Safety first: the duty of care
§ 06 · INTERPRETATIONANDHONESTLIMITS Interpretation and honest limits
§ 07 · DEPLOYMENT Deployment: protecting the person, then the evidence
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE (APPS, FAMILY PROVIDER / OTHER THE PHONE SHARING / STALKERWARE PHYSICAL / PERMISSIONS) SETUP DASHBOARD DEVICES GOOGLE SAFET Y ACCOUNT CONSIDERATION
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THESTALKERWARETHEPERMISSIONSGAVEAWAY EXAMPLE2 · THE " SPYWARE " THATWASASHAREDGOOGLEACCOUNT EXAMPLE3 · THEBROADPERMISSIONSTHATWERELEGITIMATE
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask the other side / in proceedings Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANANDROIDSUSPECTED - COMPROMISE ANA LY SIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Android suspected-compromise checklist Red flags When to involve a digital forensic expert 19. This guide continues the Android block. Through cflab.uk and e-discovery.uk, Android compromise work
§ 13 · COMMON QUESTIONS Frequently asked questions Is Android more vulnerable to stalkerware than iPhone? My client thinks their phone is being tracked. Where do we start? How can stalkerware be found on Android? Does an app with broad permissions prove it is spyware? What if the abuser controls the Google account? Should we just uninstall any stalkerware we find?
§ 14 · REFERENCE Glossary Sources and authoritative references 35 and CrimPR Part 19 reporting): cflab.uk/digital-forensics-services · guides library: cflab.uk/guides DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
§ Related documents
Guide
Wear OS And Android Paired Device Forensics
19 pages · 26 min read
Android phones are often connected to smartwatches, tablets, earbuds, and cars, forming a wider digital estate.
- Mobile and messaging evidence
Guide
IPhone Forensics The Defensible Mobile Evidence Bundle
18 pages · 26 min read
The guide details how to build a defensible mobile evidence bundle from an iPhone's diverse data sources.
- Chain of custody and defensibility
- Mobile and messaging evidence
Instruct the practice
Bring us in early.
Defensibility is built, not retrofitted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.