Stalkerware and "monitoring" apps have a pattern. They are rarely installed from Google Play. They ask to become a device administrator so they are hard to uninstall. And they want the permissions that let them watch: camera, microphone, location, SMS, call log, contacts. Alert24's suspicious apps scan looks for exactly that combination and shows you what it finds.
Open Check suspicious apps on the dashboard. The list refreshes every time you open the screen. Free accounts see how many apps were found; the names are part of Premium.
What counts as suspicious
An app appears in the list only when all of these are true. One of them alone is normal; together they are worth a look.
- Sideloaded. Installed from an APK file or a browser download, not from Google Play. Apps that came with the phone are excluded.
- Device administrator. The app has registered as a device admin, the setting that lets an app resist uninstalling and watch lock events.
- Heavy on dangerous permissions. Alert24 weighs the sensitive permissions an app declares, such as camera, microphone, location, SMS, phone and contacts. Apps above 60% of the possible weight qualify.
Review and uninstall from App info
- 1
Open the scan
On the dashboard tap Check suspicious apps. The list shows the apps that match, or a message that none were found.
- 2
Tap an app
Each row opens the Android App info page for that app, the same one you reach from Settings. You see its permissions, storage use and the Uninstall button.
- 3
Remove device admin first if needed
If Uninstall is greyed out, the app is still a device administrator. Go to Settings, search for Device admin apps, switch it off there, and come back.
- 4
Uninstall, then rescan
Return to Alert24. The list refreshes when the screen opens, so the app should be gone. Change your Google password if you think someone else installed it.
A photo when a new app is installed
Someone who installs a monitoring app on your phone has to hold the phone to do it. Alert24 can catch that moment. With the App Installed capture on (it is on by default, and needs the camera permission), the front camera takes a silent photo whenever a new app is installed while the Alert24 service is running. The photo appears in Intruders Pictures under the App Installed filter, with the time and, when available, the address.
Premium users also see a prompt when the newly installed app matches the suspicious pattern. Combined with the scan, you get both the who and the what. See intruder selfie for the other captures.
Frequently asked questions
The scan found nothing. Am I safe?
It means no installed app matches all three signs. That is good news, but not a guarantee. Also check Settings for device admin apps and accessibility services you do not recognise, and review which apps have the camera, microphone and location permissions.
Why is a banking app or my work app listed?
Some legitimate apps are sideloaded by an employer, use device admin and ask for many permissions. The scan cannot tell intent. If you know why the app is there, leave it.
Why does Alert24 need to see my installed apps?
To run the scan, the app reads the list of installed packages, their installer and their declared permissions. This list stays on the phone. See permissions explained.
Is the scan free?
Free accounts see the number of suspicious apps found. Seeing which apps they are and opening their App info page is part of Alert24 Premium.
Does the scan run in the background?
No. It runs when you open the screen. Alert24 refreshes its app list when the app starts; if you installed something a moment ago, close and reopen Alert24 to be sure it is included.
Check your phone in one tap
Install Alert24 and open Check suspicious apps. If you think someone is watching, start with the stalkerware guide and change your passwords.