How to Check if an Android APK Has Spyware (2026 Guide)

Android malware attacks surged 29% year-over-year in 2025, with over 14 million attacks blocked and 255,090 banking trojan packages detected. The platform now faces 34 active banking malware families targeting 1,243 financial institutions across 90 countries.

But here's the thing most people don't realize: Google Play Protect only catches 55-75% of novel malware. If you're installing an APK from outside the Play Store — or even one that snuck past the review process — you're gambling.

This guide walks through exactly how to check an APK for spyware, from beginner-visible red flags to professional-grade decompilation analysis.

---

What You'll Learn

• How spyware hides inside legitimate-looking APKs
• Easy checks anyone can do before installing
• Deep technical analysis (decompile the APK)
• Automated scanning tools that do the heavy lifting
• What to do if you find spyware

---

How Spyware Gets Inside APKs

Spyware doesn't always look malicious. Modern Android spyware uses several techniques to evade detection:

Technique	How it Works	Detection Difficulty
Dropper apps	Innocent-looking app downloads the real payload after install	Medium
Permission abuse	App requests excessive permissions (SMS, camera, microphone)	Easy
Native code obfuscation	Malicious logic hidden in compiled C/C++ libraries	Hard
Reflection API	Malware loads classes dynamically to avoid static analysis	Hard
Background services	Spyware runs as a system service with no UI	Medium

The Verizon 2025 DBIR found that 20% of all breaches started with vulnerability exploitation, and only 54% of critical edge-device vulnerabilities were fully remediated. Mobile apps are the new edge.

---

Method 1: The 5-Minute Manual Check (Anyone Can Do)

Before you even install a suspicious APK, check these five things:

1. Check Package Name Against the Real App

Spyware often uses package names that look almost identical to legitimate apps:

Legitimate: com.whatsapp
Fake:       com.whatsapp.free
            com.wahtsapp
            com.whatsapp.update

Use aapt dump badging <app.apk> to extract the real package name:

aapt dump badging suspicious.apk | grep "package: name"

2. Examine Requested Permissions

Legitimate calculator apps don't need access to your SMS, contacts, and location. Run this:

aapt dump permissions suspicious.apk

Red flag permissions:

• RECEIVE_SMS — intercepting text messages (2FA bypass)
• READ_SMS — reading all text messages
• PROCESS_OUTGOING_CALLS — monitoring phone calls
• BIND_ACCESSIBILITY_SERVICE — full device control
• RECORD_AUDIO — recording conversations
• CAMERA — taking photos without your knowledge

A Quokka 2026 analysis of 150,000+ mobile apps found 94.3% of Android apps contained unencrypted HTTP URLs, and 87.9% were vulnerable to SQL injection. If legitimate apps have those flaws, imagine what spyware is doing.

3. Check Certificate Information

Legitimate developers sign their APKs with consistent certificates. Spyware often uses self-signed or stolen certificates:

keytool -printcert -jarfile suspicious.apk | grep "Owner\|SHA1"

A SHA-1 that doesn't match the developer's known certificate is a strong warning sign.

4. Scan on VirusTotal

Upload the APK (or just its SHA-256 hash) to VirusTotal:

sha256sum suspicious.apk

Then paste the hash at virustotal.com. If any of the 70+ security vendors flag it, treat it as suspicious.

5. Check Network Connections

Spyware phones home. Decompile the APK and search for suspicious domains:

# Extract strings and grep for URLs
strings suspicious.apk | grep -E "https?://" | sort -u

Look for IP addresses (not domains), suspicious .top or .xyz domains, or URLs that look like C2 (command-and-control) endpoints.

---

Method 2: Deep Decompile Analysis (For Technical Users)

For a thorough investigation, decompile the APK completely:

Step 1: Decompile with APKTool

apktool d suspicious.apk -o decompiled/

This extracts the smali code, Android manifest, and all resources.

Step 2: Examine AndroidManifest.xml

Open decompiled/AndroidManifest.xml and look for:

• Exported receivers — <receiver android:exported="true"> can be triggered by other apps
• Debug mode — android:debuggable="true" in production is suspicious
• Backup abuse — android:allowBackup="true" lets malware survive factory resets
• Hidden activities — activities with no android:label or android:icon

Step 3: Search for Known Spyware Signatures

grep -r "TelephonyManager\|getDeviceId\|getSubscriberId" decompiled/smali/
grep -r "getAccounts\|ContentResolver" decompiled/smali/ | head -20
grep -r "httpPost\|HttpURLConnection\|OkHttpClient" decompiled/smali/

Step 4: Check for Surveillance Libraries

Look for these libraries in the decompiled code or lib folder:

Library	What It Does
Chucker	HTTP inspection — legitimate for debugging, suspicious in production
Flipper	Facebook's mobile debug bridge — should never be in a release build
Stetho	Chrome DevTools bridge for Android — surveillance capability
Firebase Database	Check if it's writing to a Firebase instance you don't control

---

Method 3: Automated Scanning (The Easy Way)

Manually decompiling every APK is tedious. This is exactly what we built Orange Sentinel for.

Upload any Android APK — either drag-and-drop the file or paste a download URL. Within minutes you get a full security report covering:

• Vulnerability assessment — SQL injection, insecure storage, hardcoded secrets
• Malware detection — known spyware, stalkerware, banking trojan signatures
• Secret scanning — hardcoded API keys, Firebase credentials, AWS tokens
• Permission analysis — excessive or dangerous permission combinations
• Network analysis — suspicious endpoints, plaintext communication
• Hidden capabilities — exported receivers, debug bridges, zero-click vectors

No account needed. No tracking. Pay anonymously with Solana (0.05 SOL per scan). The report is emailed with a private password — only you can view or delete it.

Upload an APK to scan →

---

What to Do If You Find Spyware

1. Don't install the APK. If you already did, put the device in airplane mode immediately.
2. Check running services: Settings → Developer Options → Running Services
3. Look for unknown Device Admin apps: Settings → Security → Device Admin
4. Factory reset if you can't identify or remove the app
5. Change all passwords — spyware often captures keystrokes and screenshots
6. Enable 2FA on all accounts using an authenticator app (not SMS)

---

Summary: Your APK Spyware Detection Checklist

• Check package name and developer certificate
• Review requested permissions (SMS, Accessibility, Camera = red flags)
• Scan on VirusTotal
• Decompile and check AndroidManifest.xml
• Search for surveillance libraries (Flipper, Stetho, Chucker)
• Use automated scanner for thorough analysis
• Verify network endpoints aren't sending data to unknown servers

---

This article is part of our mobile security series at Reindeer Software. For automated APK vulnerability scanning, try Orange Sentinel — anonymous, crypto-native, no accounts required.