Forenzi: Spyware Detector

Forenzi checks your phone against indicators of compromise published by independent security researchers, and tells you plainly what it found.

Everything happens on your device. Your app list never leaves your phone. No account, no sign-in, no analytics, no Forenzi server — nowhere for your data to be sent, even in principle.

Free. No ads, no in-app purchases, no subscription.

WHAT IT CHECKS

- Installed apps against more than 11,000 published indicators covering 180+ named spyware, stalkerware and malware families — mSpy, FlexiSpy, TheTruthSpy, FinSpy, Pegasus, Cerberus and more.
- Signing certificates. Stalkerware is routinely rebranded while re-signed with the same key, so a certificate match catches what a name list misses.
- App file fingerprints, against 3,200+ known-malicious hashes — catching a malicious build even when renamed.
- Permission combinations that indicate monitoring, including the overlay-plus-accessibility pattern used by banking trojans.
- Hidden apps — no launcher icon, installed from outside an app store, holding permissions to watch you. All three together, because any one alone is usually innocent.
- Device administrators, accessibility services and notification listeners, checked at system level so a renamed app cannot hide.
- Device state: root access, test-keys firmware, developer options, USB debugging.

DUAL-USE APPS

Family locators, parental controls and anti-theft tools use the same capabilities as stalkerware. Forenzi uses the ISDi research dataset from Cornell Tech and NYU — 5,128 Android records — to tell them apart. A dual-use app is labelled as exactly that: an app that can share your location, worth checking who it is shared with, not spyware.

DEEPER TOOLS

- Deep forensic scan. Generate an Android bug report yourself and share it into Forenzi. It is parsed on your device against the full indicator set, then deleted — never uploaded.
- Intrusion log. On Android 16 with Advanced Protection on, Forenzi reads Android's own tamper-evident security log and summarises it.
- Evidence report. Export any scan as text and JSON with a SHA-256 integrity line, so a helpline worker, lawyer or investigator can confirm nothing was altered afterwards.
- Activity monitor. Which apps have been running and moving data, with the permissions each holds. An app with network traffic and no screen time is worth a second look.

Indicators come from the Amnesty International Security Lab, ECHAP, the Mobile Verification Toolkit project and the ISDi dataset — the same open data professional investigators use. Forenzi is not affiliated with them.

WHAT IT CANNOT DO

Forenzi finds threats someone has already documented publicly. It cannot find novel or unpublished spyware, inspect encrypted traffic, or see inside another app's private data — Android permits no app to do those things. A clean result means nothing known matched; it is not proof your device is clean.

If you have specific reason to think you are being targeted — as a journalist, an activist, or someone in an unsafe relationship — talk to a human expert rather than relying on any app. Access Now's Digital Security Helpline (accessnow.org/help) is a good place to start.

IF YOU FIND STALKERWARE

Stalkerware is usually installed by someone with physical access, often an abusive partner. Removing it can alert them and escalate the danger to you. Forenzi says so before suggesting removal, and points you to stopstalkerware.org first.

PRIVACY

No analytics SDKs, no crash reporting, no advertising identifiers, no third-party trackers.

Forenzi makes exactly one network request, and only when you tap Update Indicators: a public file from the researchers' own repositories. Nothing about you or your device goes with it.

Forenzi cannot silently remove anything. Every uninstall goes through Android's own confirmation dialog.

Full policy: https://enneslabs.com/privacy/forenzi

From Ennes Labs. info@enneslabs.com