Catch Me If You Scan: A Longitudinal Analysis of Stalkerware Evasion Tactics

Add to your list(s) Download to your calendar using vCal

• Anahitha Vijay (University of Cambridge)
• Friday 31 October 2025, 14:00-15:00
• Webinar & FW11, Computer Laboratory, William Gates Building..

If you have a question about this talk, please contact Alexandre Pauwels.

Stalkerware–mobile software that enables covert surveillance, especially in intimate partner relationships–persists as a significant threat on the Android ecosystem despite platform-level policy and security enhancements. We present the first multi-application longitudinal analysis of the stalkerware ecosystem. We analyse 82 APKs from four prominent stalkerware brands sourced from official, third-party, and modded marketplaces, mapping their technical evolution against key policy and OS updates from 2012 to 2025. We find a strategic dichotomy in developer behaviour based on distribution channels. Applications distributed on third-party channels, away from Google Play, consistently target older, less-secure APIs to preserve invasive functionality, effectively ignoring platform policies. In contrast, developers on the Google Play platform respond reluctantly, often employing malicious compliance (e.g., obfuscated notifications) or strategic re-architecting (e.g., ‘split-app’ models) to circumvent rules while maintaining a market presence. Our findings suggest that platform policies displace rather than eliminate abusive functionality. By systematically documenting how stalkerware developers navigate and subvert platform governance, we provide a nuanced understanding of their adaptive capabilities, offering critical insights for developing more robust, future-proof detection and mitigation strategies.

This talk is part of the Computer Laboratory Security Seminar series.

This talk is included in these lists:

• All Talks (aka the CURE list)
• Cambridge talks
• Computer Laboratory Security Seminar
• Department of Computer Science and Technology talks and seminars
• Interested Talks
• School of Technology
• Security-related talks
• Trust & Technology Initiative - interesting events
• Webinar & FW11, Computer Laboratory, William Gates Building.
• bld31
• yk449

Note that ex-directory lists are not shown.