Malware, spyware and stalkerware: three words, three responses

Summary

• Malware is the umbrella term for software built to harm or gain unauthorized access. Ransomware, spyware and stalkerware are three branches, defined by what they do and who is behind them.
• Ransomware encrypts files and demands payment, often with a threat to leak stolen data. In 2025 the FBI's Internet Crime Complaint Center (IC3) received more than 3,600 ransomware complaints and says its loss figure is likely low.
• Commercial spyware is built to watch one person covertly. The record includes a leaked target list reported in 2021, a U.S. export restriction on the maker of Pegasus, an executive order restricting U.S. government use of such tools, and a U.S. court that found the same maker liable for attacking WhatsApp users.
• Stalkerware is commercially available software that someone, usually with brief physical access, installs to watch another person. The U.S. Federal Trade Commission (FTC) has banned one such vendor from the surveillance business. Advocates say a victim should plan for safety before removing it.
• The first call differs: law enforcement for ransomware, a digital-security helpline and an examiner for suspected targeted spyware, a domestic violence advocate for stalkerware.

Why the words matter

"Hacked" covers a stolen password, a locked laptop and a phone that someone else is reading. The response to each is different. A business owner whose files are encrypted should be reporting a crime. A journalist who suspects state surveillance should be talking to people who investigate such cases. A woman who suspects her ex-partner is tracking her phone may be put in danger by a quick fix. Getting the word right is the first step to getting the response right.

The words are also not fully clean categories. NIST, the U.S. standards institute, notes in its malware guide that real malware often combines several methods and that the classic categories matter less than they used to for incident handling. We use the terms below as a map of purpose and relationship, and we say where they overlap.

Malware: the umbrella

NIST defines malware as a program covertly inserted into another program with the intent to destroy data, run destructive or intrusive programs, or otherwise compromise the confidentiality, integrity or availability of the victim's data, applications or operating system. It is a category, not a specific threat. NIST's classic list includes viruses and worms, which copy themselves, and Trojan horses, which appear harmless but have a hidden purpose.

Ransomware is the branch most people meet through the news. CISA, the U.S. cybersecurity agency, describes it as an ever-evolving form of malware designed to encrypt files on a device and demand payment for decryption, and says its operators also threaten to sell or leak stolen data. In 2025 IC3 received more than 3,600 complaints about ransomware, with reported losses above 32 million dollars. IC3 says the figure does not normally include lost business, time, wages, files, equipment or outside recovery costs, that some victims report no loss, and that it counts only what is reported to IC3. Treat the number as a floor. IC3 asks victims of ransomware to file a report and points to the CISA #StopRansomware guide.

Spyware: watching without permission

NIST's glossary defines spyware as software secretly or surreptitiously installed to gather information on individuals or organizations. It is built to watch, not to lock or damage. What it can collect depends on the tool. Messages, location, files and, in some tools, the microphone and camera are the usual targets.

The sharpest form is commercial spyware sold to governments. Three parts of the public record show how it has been treated.

The Pegasus Project. In July 2021 Amnesty International and the Forbidden Stories consortium reported on a leaked list of more than 50,000 phone numbers that they said were selected for surveillance by customers of NSO Group in more than 50 countries since 2016. They said the list included at least 180 journalists. Amnesty's Security Lab examined phones and, according to Forbidden Stories, confirmed an infection or attempted infection in 85 percent of the cases examined, 37 in total. The Citizen Lab at the University of Toronto reviewed Amnesty's forensic methods and found their core to be sound. Being on the list is not proof that a phone was infected. NSO denied the reporting, calling it based on wrong assumptions and uncorroborated theories.

U.S. government action. On 3 November 2021 the Commerce Department added NSO Group and a second Israeli company, Candiru, to its Entity List, which restricts exports to the listed parties. According to the Commerce Department's press release, the evidence was that the two developed and supplied spyware to foreign governments that used it to target government officials, journalists, business people, activists, academics and embassy workers. NSO said it was dismayed by the decision. On 27 March 2023 Executive Order 14093 barred U.S. agencies from operational use of commercial spyware where they determine on credible information that it poses significant counterintelligence or security risks, or significant risks of improper use by a foreign government or person.

The courts. WhatsApp sued NSO Group in 2019. In December 2024 a federal judge in California found NSO liable under the federal Computer Fraud and Abuse Act and a California computer fraud law, and for breach of WhatsApp's terms, in a case that involved about 1,400 WhatsApp users. In May 2025 a jury awarded WhatsApp punitive damages of 167.3 million dollars. On 17 October 2025 the judge cut that award to about 4 million dollars and issued a permanent injunction barring NSO from targeting WhatsApp and its users, which does not apply to NSO's customers. NSO has long said its tools are for government and law-enforcement use, and said the reduced award is still disproportionately high.

Government-grade spyware usually arrives remotely, and in cases described by Amnesty (Pegasus) and by Kaspersky (a different campaign) it needed no action from the target (see LAB-0018). Apple sends threat notifications to users it believes have been individually targeted by mercenary spyware, and says the vast majority of users will never be targeted.

Stalkerware: when the watcher is someone you know

The Coalition Against Stalkerware, founded in November 2019, describes stalkerware as tools, meaning software programs, apps and devices, that enable someone to secretly spy on another person's private life. Kaspersky's annual report defines it as commercially available software that can be discreetly installed on a smartphone. Technically stalkerware is a form of spyware. What separates it is the relationship. The watcher is usually a partner, ex-partner or family member, and the software is bought by an individual, not a state.

The National Network to End Domestic Violence says almost all phone stalkerware requires physical access to the device to install. That is why a passcode that only you know matters. The FTC lists warning signs: faster battery drain, unexpected data use, overheating, a phone that turns itself off and on, and an abuser who knows your location or the content of private conversations. The first group can have innocent causes. NNEDV says the most common clue is the other person knowing things they should not.

The scale is hard to measure. Kaspersky counted 31,031 unique users of its mobile products affected by stalkerware in 2023, up from 29,312 in 2022, in 175 countries, with 799 in the United States. Those are users of one vendor's products and the true number is higher. The FTC acted against one vendor: the complaint against Support King, LLC, which operated SpyFone, is dated 26 August 2021, and its final order of 21 December 2021 bans the company and its chief executive from the surveillance business. The FTC alleged the company secretly collected and shared data on people's movements, phone use and online activity.

Different threat, different first call

Figure 2 matches each situation with the first step that public sources support. The stalkerware row is the one most often done wrong. The FTC, the Coalition Against Stalkerware and the National Network to End Domestic Violence all advise that removing stalkerware can alert the person watching and may increase the abuse. They advise a domestic violence advocate first, a safe device for the call, and a safety plan. The FTC gives the National Domestic Violence Hotline as 1-800-799-7233. The Coalition adds that removing the software also removes evidence, so a victim who may want to report should think about that first.

For a phone that may need to be replaced or reset, the FTC calls a new phone with accounts the abuser cannot access the safest option, and the Coalition calls a factory reset almost as effective. Both say not to restore apps from a backup that might reinstall the software. On the iPhone, Apple's Safety Check shows and stops what you share with people and apps, and Apple says it cannot see everything, such as accounts and passwords or sharing from another device. Android phones differ by maker, so look for the manufacturer's own guidance.

One phone can carry more than one risk. The phone that holds a stalkerware app may also be the phone that runs your banking app, and the habits that expose a person to one threat, such as delaying updates, widen the door for others. That is why it helps to know which threat you are asking about before you ask for help.

What an examiner can and cannot conclude

Stalkerware. An examiner can report that an app is installed, which permissions and special access it holds, when it was installed if the device keeps that, and that its presence is consistent with monitoring. An examiner cannot say who installed it, whether anyone read what it collected, or what the installer meant to do. The finding is about the app and the device. It is not a finding about a person's conduct. The Lab publishes a synthetic teaching set on how such apps can be told from benign look-alikes, and why false positives matter (DS-0006).

Targeted spyware. The examiner can say which published indicators were present in the data examined. The examiner cannot certify a phone clean, and the device alone does not name the buyer (LAB-0018). A name on a leaked list is not an infection, and an infection finding needs the device.

Ransomware. The examiner can describe what is encrypted and what the artifacts show about how it arrived. Whether data was taken and whether it will be leaked often turn on network records and on the attacker's own statements, not on one device.

For all three. An empty or missing result is not proof that nothing happened (LAB-TR-0034), and a victim should decide with an advocate whether the evidence should be preserved before anything is removed.

What this article does not claim

Sources

Every number and claim, and where it comes from. Web pages were read on 2026-11-08. The Commerce Department's own press release could not be retrieved by the Lab's tools, so its wording is cited through the press report. Statements that could not be sourced were left out. LAB-TR-0034 is a Lab Technical Report on this site, with no DOI yet.

Version history and corrections

Corrections log

No corrections have been published for this article. Corrections to any article are listed on Corrections, with the version they apply to.

Related