Detecting Stalkerware on the iPhone Apfelpatient

Stalkerware is the dark side of commercial spyware – surveillance software deployed not by intelligence agencies, but by people close to the target. On the iPhone, this works differently than on Android devices, but it remains just as dangerous. What stalkerware actually is, how it gets onto the iPhone, and which concrete steps help when suspicion arises.

In Germany, stalkerware is a documented and growing problem. According to Kaspersky's annual "State of Stalkerware" report, Germany has been the most affected country in Europe for years – in 2023, with 577 recorded victims, it topped the list ahead of France, Great Britain, Spain, and Italy. An accompanying Kaspersky survey shows that one in three people in Germany has already experienced digital stalking. Behind these figures are not state-sponsored hacking groups or intelligence agencies, but almost always people from the victims' immediate circle: ex-partners, family members, or abusive acquaintances. The smartphone becomes a tool for control, blackmail, and stalking – and the iPhone is no exception, even though Apple significantly restricts the market for stalkerware through its closed platform. Those who understand the mechanisms by which stalkerware gets onto iPhones can specifically search for traces and implement protective measures. Information about Pegasus and commercial spyware has highlighted the state side of this problem – stalkerware is the private version, with its own entry points and identifying features.

What Stalkerware Actually Is

Stalkerware refers to commercial surveillance software that is usually officially advertised as "parental control," "employee monitoring," or "anti-theft solution," but in practice is primarily used to monitor the behavior of an adult without their knowledge. Numerous providers of this type of software exist on the market, distributing their products through their own websites or via online subscriptions. They operate in a legal gray area—their products are technically available, but their use without the consent of the monitored person is punishable in Germany under Section 238 of the Criminal Code (stalking) and, depending on the circumstances, also under Section 202a of the Criminal Code (unauthorized access to data).

Depending on the variant, the functions range from location tracking and reading along with messages and calls to activating the microphone and camera. The data is routed to a server operated by the provider and made available to the monitoring person through a web dashboard or a dedicated app. Anyone deploying stalkerware usually has to pay a monthly subscription – the market is large and well-established.

How Stalkerware Gets Onto the iPhone

Unlike on Android, iOS is so closed that no stalkerware can be loaded from the App Store – Apple's review process reliably filters out such apps. For the iPhone, there are therefore three realistic ways by which stalkerware actually reaches the device:

Apple account credentials and iCloud synchronization: This is the most common method. Some vendors sell a "no-jailbreak" version that doesn't infect the iPhone itself, but instead taps into the victim's Apple account. Anyone who knows the victim's password and ideally their 2FA code can access iCloud backups, photos, messages, contacts, notes, and location data without ever physically handling the device. The prerequisite: Two-factor authentication must be bypassed or disabled. Once 2FA is active, this attack method usually fails because Apple sends a confirmation to the victim's trusted devices with every login attempt from a new device.

Jailbreak-based spyware: The older, more technically invasive variant. Anyone with physical access to an unlocked iPhone who performs a jailbreak can subsequently install full-featured surveillance apps from the gray market. These apps run hidden in the background, read along with messages directly, activate the microphone and camera, and transmit everything to an external server operated by the provider. On modern iPhones with current iOS, jailbreaking has become significantly more difficult – but it remains possible on older devices or outdated software.

Configuration profiles as a foothold: A configuration profile is the more inconspicuous variant. It's installed in seconds as soon as someone briefly has access to the unlocked iPhone, or the victim is tricked by a phishing email into confirming a profile. What this means in detail and how suspicious profiles can be tracked down is covered in depth by the dedicated guide on configuration profiles on the iPhone.

What all three paths have in common: They require either knowledge of the Apple Account password or brief physical access to the unlocked device. That's exactly the typical constellation in relationships, families, or shared living environments.

Warning Signs That Point to Stalkerware

Stalkerware is harder to detect on the iPhone than on Android, but it leaves traces. The following signals, taken individually, are not proof, but in combination they're a clear warning sign:

The battery drains noticeably faster than usual without any change in usage
The iPhone becomes noticeably warm even in standby
Cellular or Wi-Fi data usage increases without any change in behavior
Apps open with a delay, the system feels generally sluggish
Unknown apps or configuration profiles appear in the settings
The “Find My iPhone” feature has been unexpectedly disabled.
Location access for individual apps has been changed without any action of your own
Notifications about unfamiliar logins to the Apple Account appear that you don't remember
The Apple Account unexpectedly demands a new password
Signs of an active jailbreak: apps like Cydia, Sileo, or Zebra that don't come from the App Store
The warning signs of a hacked iPhone apply here as well and provide further indicators

Important: Apple's protective mechanisms can mask many of these traces. Anyone with a justified suspicion shouldn't wait for individual symptoms, but should go through the steps described in the next section directly.

Apple's Safety Check as the Central Tool

With iOS 16, Apple built in a dedicated workflow specifically for stalking and abuse scenarios: Safety Check. It's located under Settings > Privacy & Security > Safety Check and is the central lever for cutting all connections of a monitoring person to your own device and Apple Account in one go.

Safety Check offers two options:

Emergency Reset: The radical variant. It ends all sharing with other people in one go, disables app access to location, contacts, photos, and more, signs the device out of all linked Apple Accounts, and asks for an update of the Apple Account password. This variant is the right choice in acute danger – for instance when the monitoring person lives in the same household or when there's a suspicion of systematic data access.

“Share & Manage Access”: The granular option. Here, you can see and decide exactly which information is shared for each person and each app – location sharing, calendar, photo albums, reminders, health data. This option is useful if you only want to restrict individual sharing permissions or if it's unclear what information is being shared at all.

An important detail: In both modes, Apple offers the Quick Exit button in the upper right. With one tap, Safety Check is closed immediately and the iPhone jumps to the home screen – without any trace of which submenu you were last in. This is explicitly designed for situations in which the monitoring person suddenly enters the room. Changes made up to that point remain saved.

Running Safety Check

The steps for the security check in detail:

Open Settings
Tap Privacy & Security
Scroll down and select Safety Check
Choose between Emergency Reset or “Manage ”Sharing & Access”
Go through the individual sections step by step

Safety Check guides you through five central areas, each of which is confirmed individually:

People and shared information – which location sharing, calendars, photo albums, and health data go to whom
Apps and permissions – which apps have access to location, contacts, microphone, camera, photos, and more
Devices on the Apple Account – which iPhones, iPads, Macs, and Apple Watches are linked to your Apple Account
Trusted phone numbers – which numbers the 2FA codes are sent to
Apple Account password and emergency contacts – the option to change the password immediately and set emergency contacts

On iPhones running iOS 17 or later, Safety Check can additionally remove synced computers and activate Apple's iCloud Private Relay, provided an iCloud+ membership exists.

Additional Steps When Stalkerware Is Suspected

Safety Check is a central tool, but when a concrete stalkerware suspicion is at hand, it doesn't replace all further steps. The following make sense in addition:

Fully re-secure the Apple Account. Change the password, end all existing sessions, set up 2FA from scratch, and go through trusted phone numbers and emergency contacts completely. With a justified suspicion of long-term access, it's also worth taking a look at saved email aliases and recovery options.

Check configuration profiles. Under Settings > General > VPN & Device Management. Remove all unknown profiles – when in doubt, better delete one too many.

Check for jailbreak traces. Use the search function (swipe down on the home screen) to look for typical jailbreak app names such as Cydia, Sileo, or Zebra. If such apps are found, a jailbreak is likely – in that case, only a full factory reset helps.

Rethink the backup strategy. Anyone using iCloud backups should review what data is stored there and whether Advanced Data Protection for iCloud is active. Even with suspicious access to the Apple Account, existing iCloud backups are not automatically deleted.

Factory reset without backup restoration. If stalkerware is confirmed or highly likely, only a full reset of the iPhone helps. Important: The backup the device previously pulled data from may already be compromised. In that case, it's better to set the device up as a new iPhone instead of restoring from an old backup.

Regular Apple security updates and Stolen Device Protection already close many attack paths preventively. Both features are part of the basic equipment of any iPhone security strategy.

What Apple's Protection Mechanisms Don't Cover

For all the effectiveness of Safety Check, there are limits that are important to know:

Apple doesn't provide a stalkerware scanner. Unlike on Android, there's no official Apple feature that explicitly searches for spy apps or iCloud access by stalkerware.
There are no access logs for the Apple Account. Anyone using stalkerware via iCloud sync leaves traces on the linked devices, but not in a detailed login log that could be reviewed in depth.
A successful Safety Check doesn't prevent the monitoring person from attempting access again. Anyone living in the same household or knowing the password can start the process from scratch. Safety Check is a reset, not a permanent barrier.

In particularly serious cases – separations involving violence, domestic abuse, acute threat situations – no technical solution replaces going to the police and to specialized counseling services. The German nationwide Violence Against Women Helpline is reachable around the clock at the short number 116 016 – anonymous, free of charge, multilingual, and barrier-free. The Victim Hotline of Weisser Ring at 116 006 offers free counseling daily from 7 a.m. to 10 p.m. on all consequences of crimes. In case of acute danger, 110 is the police emergency number.

Detecting Stalkerware on the iPhone – the Key Points at a Glance

Stalkerware is the silent tool of a form of intrusion that takes place much closer to one's own life than most people assume. On the iPhone, it reaches the device via three routes: through compromised Apple Account credentials, through a jailbreak after physical access, or through configuration profiles. Anyone with a suspicion should immediately run Apple's Safety Check, review configuration profiles, change the Apple Account password, and set up 2FA from scratch. Apple's protection mechanisms help significantly here – but they're no substitute for professional help in acute cases. Anyone facing a threat from within their family or partnership has a right to support – technically as well as personally.

Time for fresh accessories? Visit our Amazon Storefront and discover a wide selection of products from leading manufacturers, including HomeKit accessories! (Image: Shutterstock / your)

Frequently Asked Questions: Stalkerware on the iPhone

What's the difference between stalkerware and spyware like Pegasus?

Spyware like Pegasus is deployed by state actors or intelligence agencies and costs several hundred thousand euros per target. Stalkerware is the commercial variant – cancelable monthly, available online, deployed almost always by people from the direct surroundings of those affected. The two categories overlap technically but differ in reach and target group.

Can stalkerware get onto the iPhone without physical access?

Yes, but only via one method: Some providers offer a "no-jailbreak" option that works exclusively with compromised Apple account credentials – without access to the device itself. This method usually fails as soon as two-factor authentication is enabled, because every new login requires confirmation.

Does 2FA fully protect against stalkerware?

Against the iCloud-based variant, in most cases yes – provided no one has parallel access to the trusted devices or phone numbers. Against jailbreak-based spyware and configuration profiles installed after physical access, 2FA does not protect.

What is Apple's Safety Check?

A feature built into iOS 16, found under Settings > Privacy & Security > Security Review, allows you to revoke all access to other people and apps, change your Apple account password, remove linked devices, and reset trusted phone numbers in a single workflow. The "Quick Quit" button allows you to exit the process immediately at any time.

Which emergency numbers help with domestic violence and stalking in Germany?

The Violence Against Women Helpline is reachable around the clock at 116 016 – anonymous, free of charge, multilingual. The Victim Hotline of Weisser Ring (116 006) offers free counseling daily from 7 a.m. to 10 p.m. on all consequences of crimes. In case of acute danger, 110 dials the police.

Is an iPhone reset enough to remove stalkerware?

For jailbreak-based spyware, yes – a full factory reset removes the jailbreak and with it the spyware. Important: Don't restore the old iCloud backup, since it may already contain compromised data. For iCloud-based stalkerware, a reset isn't enough – here, the Apple Account additionally has to be re-secured.

Is installing stalkerware a criminal offense in Germany?

Yes. Installing surveillance software without the consent of the monitored person fulfills, depending on the constellation, the offense of stalking under section 238 of the Criminal Code and unauthorized access to data under section 202a. Both are criminal offenses that can be reported to the police.

Make Apfelpatient a preferred source One click – and you'll see us more often on Google

Was this article helpful?

YesNo