Signs your iPhone might have spyware

Spyware on an iPhone usually shows itself through behavior changes you can spot without special tools. Your phone may drain its battery much faster than normal, even when you are not using apps. The device might get hot during regular tasks like texting or browsing, or slow down noticeably when opening apps that used to open instantly.

Watch for data usage spikes in your Settings app — go to Settings, then Cellular, and scroll down to see which apps are using the most data. If an app you rarely use is consuming gigabytes, that is a red flag. You might also notice your phone using data even when you have Wi-Fi turned on, or receiving text messages that contain only strange characters or symbols.

Listen for unusual sounds during calls — crackling, beeping, or echoing can indicate call interception. If your contacts tell you they received messages from you that you never sent, or if you see text threads you do not remember starting, someone may have access to your messages.

Key Takeaways

  • Battery drain, overheating, and unexpected data usage are the most common signs spyware is running on your iPhone.
  • Check your installed apps in Settings and remove anything you do not recognize or remember downloading.
  • Restart your phone in Safe Mode by holding the power button, then sliding the power-off slider, then pressing and holding the power button again until you see the Apple logo.
  • If you suspect spyware, back up your important data through iCloud, then restore your iPhone to factory settings using Settings > General > Transfer or Reset.
  • Spyware often requires physical access to install, so change your Apple ID password and enable two-factor authentication to prevent future compromise.

Check your installed apps and recent downloads

Open Settings and tap General, then iPhone Storage. This screen shows every app on your phone, sorted by how much space each one uses. Scroll through the entire list and look for apps you do not remember installing. Spyware sometimes disguises itself with names that look like system apps — for example, "System Services" or "Settings Manager" — so pay attention to anything that sounds generic or vague.

Tap on any suspicious app to see when it was installed. If the date surprises you, or if you have no memory of downloading it, that app is worth investigating. Check the app's developer name by tapping the app name itself — legitimate apps show a real company name, while spyware often lists generic or nonsensical developer information.

Do not delete apps yet. First, note which ones seem suspicious, then move to the next step. Some spyware will reinstall itself if you simply delete it without addressing the root problem.

Restart your iPhone in Safe Mode

Safe Mode prevents most third-party apps from running, which stops spyware from executing while you investigate. To enter Safe Mode on an iPhone with Face ID (iPhone X and newer), hold down the side button and either volume button together until the power-off slider appears. Do not slide it yet. Instead, release the buttons, then press and hold the side button alone until you see the Apple logo appear — this takes about 30 seconds.

On an iPhone with a home button (iPhone 8 and earlier), hold the top or side button until the power-off slider appears, release it, then hold the home button until the phone returns to the home screen. Your phone will show "Safe Mode" in the status bar at the top.

While in Safe Mode, use your phone normally for a few minutes. If the battery drain stops, the overheating ceases, or the strange behavior disappears, spyware is almost certainly present. Exit Safe Mode by restarting your phone normally — hold the power button and slide to power off, then turn it back on.

Review your iCloud activity and connected devices

Go to Settings, tap your name at the top, then select Password & Security. Scroll down and tap Devices. This screen shows every device signed into your Apple ID — iPhone, iPad, Mac, Apple Watch, and any others. Look for devices you do not recognize or no longer own. If you see a device that should not be there, tap it and select Remove.

Next, check your iCloud activity by going to Settings > [Your Name] > Password & Security > Review Your Account Activity. This shows login attempts and locations where your account was accessed. If you see sign-ins from places you have never been or at times you were asleep, someone else has your password.

Change your Apple ID password immediately. Go to Settings > [Your Name] > Password & Security > Change Password. Use a strong password with uppercase letters, lowercase letters, numbers, and symbols. Enable two-factor authentication if you have not already — tap Two-Factor Authentication and follow the prompts.

Restore your iPhone to factory settings

Factory reset is the most reliable way to remove spyware completely. Before you do this, back up your data through iCloud so you do not lose photos, contacts, or messages. Go to Settings, tap [Your Name], then iCloud, then iCloud Backup. Tap Back Up Now and wait for the backup to finish — this can take several minutes depending on how much data you have.

Once the backup is complete, go to Settings > General > Transfer or Reset. Tap Erase All Content and Settings. Your phone will ask for your Apple ID password — enter it. The reset process takes 10 to 30 minutes. Your iPhone will restart several times and eventually show the setup screen, as if it were brand new.

When setup completes, you can restore from your iCloud backup by signing in with your Apple ID and selecting Restore from iCloud Backup. This brings back your photos, messages, and settings, but removes the spyware because it was not part of your backup — only your data was backed up, not the malicious software.

Prevent spyware from returning

Spyware usually requires someone to physically hold your phone and install it, or to trick you into clicking a malicious link. Protect your device by never leaving it unattended in places where people you do not trust have access. Do not click links in text messages or emails from unknown senders, even if they claim to be from Apple or your bank.

Keep your iPhone updated by going to Settings > General > Software Update and installing updates as soon as they become available. Apple releases security patches regularly, and spyware often exploits older vulnerabilities that patches have already fixed.

Turn off automatic app installation by going to Settings > App Store and making sure Automatic Downloads is turned off for apps. This prevents someone with access to your Apple ID from remotely installing apps on your phone. Review your App Store purchases occasionally by opening the App Store, tapping your profile icon, and scrolling through your purchase history.

When to contact Apple Support

If you have completed these steps and still see signs of spyware, or if you cannot restore your iPhone because it keeps showing errors, contact Apple Support. Go to support.apple.com, select your device, describe your problem, and choose to chat with a specialist or schedule a call. You can also visit an Apple Store in person — bring your phone and explain what you have observed.

Apple Support can run diagnostics that you cannot run yourself, and they can help you restore your phone if the standard reset process is not working. If you believe someone has compromised your Apple ID specifically, Apple can review your account security and help you lock it down further.

Frequently Asked Questions

Can spyware hide from Safe Mode?

Most spyware cannot run in Safe Mode because the mode disables third-party apps. However, some sophisticated spyware can hide in system-level processes. If your phone still shows battery drain or overheating in Safe Mode, the problem may be hardware-related rather than spyware, and you should contact Apple Support.

Will restoring from iCloud backup put spyware back on my phone?

No. iCloud backs up your data — photos, messages, contacts, calendar events — but not apps or system files. Spyware is removed during the factory reset and will not return when you restore your backup, because the backup contains only your personal data, not the malicious software.

What if I think someone is physically accessing my phone?

Change your passcode to something only you know, and do not share it with anyone. Enable Face ID or Touch ID so your phone locks immediately when you are not using it. Consider using a privacy screen protector so people cannot see your screen from the side. If you believe someone is accessing your phone without permission, you may want to contact local law enforcement.

Can spyware survive a factory reset?

Standard spyware cannot survive a factory reset because the reset erases everything on your phone and reinstalls the operating system fresh. However, if someone has physical access to your phone after the reset, they can install spyware again. Change your Apple ID password and enable two-factor authentication to make reinstallation much harder.

Do I need antivirus software on my iPhone?

iPhone does not support traditional antivirus apps the way Android does. Apps claiming to scan for viruses on iPhone cannot actually scan your system — they can only check websites you visit. The steps in this guide are more effective than any app at detecting and removing spyware.