EFF and AV-Comparatives: stalkerware detection is still a mixed bag

Joint research from the Electronic Frontier Foundation (EFF), a founding partner of the Coalition Against Stalkerware, and independent testing organization AV-Comparatives shows a mixed picture when it comes to detection of stalkerware by antivirus products.

Stalkerware refers to apps that are designed to be installed covertly on another person’s device and exfiltrate data from that device without their knowledge. They are often used to spy on a partner or ex-partner’s phone activities and form part of the wider problem of tech-enabled abuse, where technology is used to exert power, control, and intimidation over someone, often a present or former partner.

Stalkerware is typically installed through manual access to a device. In the test, the stalkerware apps were installed by following the instructions provided by the app. This often included disabling Google Play Protect, the antivirus product installed on many Android devices by default. This would explain why the product blocked only 53% of stalkerware installations, though this is only marginally worse than the second poorest performing antivirus product.

Only one tested product, of Coalition founding partner Malwarebytes, achieved a 100% detection rate for Android stalkerware in the test, with several other products missing one out of 17 tested stalkerware apps. 

The number of tested stalkerware apps (variations of the same underlying product were only counted once) is slightly lower than in tests performed in 2020 and 2021. While this is a good thing and might be related to increased attention from regulators, notably in the US, it may also be that those trying to track an (ex-)partner are moving to other methods, such as Bluetooth-enabled physical trackers.

The full test report can be found here as a PDF.