Uncovering the Deceptive Tactics of Stalkerware: A Large Scale Measurement Study

Abstract

Stalkerware apps pose a significant risk to individual privacy. Existing works have mostly focused on studying leading stalkerware apps, dual-purpose apps, monetization of stalkerware, or the experience of survivors. However, our understanding of the resilience tactics of stalkerware and its evolution in response to privacy protection mechanisms is more limited. In this paper, we perform a systematic analysis of a large corpus of recent Android stalkerware apps, combining multiple analysis techniques to quantify stalkerware capabilities, their deceptive tactics, and how these evolved over time, particularly in response to Android changes. Our investigation reveals new insights into the deceptive tactics used by stalkerware, including the way they instruct users to bypass OS protection, and the mismatch between their actual and advertised capabilities.