A mobile security team should evaluate anti-spyware by what it protects inside the app: can it keep sensitive data from being recorded, mirrored, read from the screen or lifted from memory, and does it say so when that happens? Otukan answers each of those at the app. It hides protected content while recording or mirroring is active, detects instrumentation in the app’s process, flags rooted and jailbroken devices, and on Android catches non-assistive services reading your screens. Signals reach your backend with the session. Otukan does not scan the whole device or confirm an infection; it protects and reports what your app can see.
Attack behaviour
What spyware wants from your app
Spyware is built to watch, not to break things. Its value lies in private messages, documents, account balances, identity data and the codes that unlock accounts. Stalkerware installed by someone close to the victim, commercial surveillance tools and data-stealing trojans differ in who runs them, but inside your app they rely on a short list of behaviours.
The victim journey
The victim rarely knows. They open your app, read a message or view a statement, and the content leaves the device through a recording, a mirrored display, a service reading the screen or code sitting in the app’s process. Nothing looks different to them. The party best placed to notice in real time is the app itself.
Behaviour-to-signal matrix
| Spyware behaviour | Android signal | iOS signal | Otukan response |
|---|---|---|---|
| Recording the screen | Capture state; secure flag on protected screens | Capture state; screenshot notice | Blank protected content |
| Mirroring or sharing the display | Display and sharing state | Mirroring state | Mask sensitive fields |
| Reading screen text | Non-assistive accessibility service active | Not available to third-party apps | Withhold protected views |
| Reading app memory | Instrumentation in the process | Instrumentation in the process | Restrict or end the session |
| Running with elevated control | Root indicators | Jailbreak indicators | Restrict sensitive areas |
Detection limits
App-visible signals
Otukan works with what each platform lets an app observe about itself and its screens. That view is narrow and reliable: when a protected screen is being recorded, the app knows, and so does your backend.
What stays outside the app
Listing every installed app, inspecting other apps’ storage or confirming that a named spyware product is present are jobs for device security and forensic tools. They need permissions and access an ordinary app does not have. Otukan’s evidence complements those tools: it shows the exposure that mattered to your service, with the screen, time and app version.
Signals, not verdicts
A recording during a protected screen can be a customer capturing their own statement. Otukan reports the behaviour and applies your policy; your team decides what it means across sessions.
Response
Proportionate controls
Masking protected content during capture costs a legitimate customer almost nothing and denies spyware what it came for, so it suits most private screens. Restricting a feature or ending a session fits clearer evidence, such as instrumentation in the process on an account settings screen. Otukan applies these per flow.
Support paths for people at risk
Someone being watched needs a safe route, not a loud alarm. Otukan lets you keep responses silent on the device and visible only to your team, or show short neutral wording that points to a trusted support channel. Your support staff can then help the customer check their device properly.
What your team receives
Every spyware signal arrives as a record your security and fraud teams can read: the behaviour observed, the screen it happened on, the platform, the app version and the response the app applied. Recorded over time, those records show which private screens attract the most exposure and which customers see repeated signals, so protection effort goes where it is needed.
Proving it before release
Each signal is shown in an authorised simulation, repeated on a clean device with ordinary tools such as video calls and screen sharing, then checked again through install, update, sign-in and the most private flow. Results carry device, OS version and reviewer.
For an evaluation checklist, see the anti-spyware solution guide. Anti-spyware sits within Otukan’s mobile fraud prevention controls.