How to Tell If Someone Is Spying on Your Computer (Windows & Mac Guide)

Your laptop fan is roaring while you are only reading email. The webcam light blinked on for a second and then went dark. Your battery drains faster than it used to. Individually, none of these things is alarming. Together, they can leave you wondering whether your computer is being monitored.

That suspicion is not paranoid. Spyware, stalkerware, keyloggers and remote access tools are real, widely available and often easy to install by anyone with brief physical access to a device or a single careless click from the victim. Employers, jealous partners, scammers, identity thieves and ordinary criminals all use them for different reasons.

The good news is that most spying software leaves traces. This guide walks you through the signs of spyware on a computer, shows you exactly how to check both Windows and Mac for monitoring software, and explains how to remove spyware safely and keep it from coming back.

How Can You Tell If Someone Is Spying on Your Computer?

The most common signs that someone is spying on your computer are:

Your computer suddenly runs slowly, freezes or overheats for no clear reason
Your webcam light turns on by itself, or your microphone indicator appears when you are not on a call
Your network activity or data usage is high while the computer is idle
You find unfamiliar apps, browser extensions or processes you never installed
Your antivirus or security settings are disabled and you did not disable them
Your passwords, accounts or settings change without your involvement
Files, windows or the cursor move on their own
The battery drains faster than normal and the fans run constantly

If you notice more than one of these, run through the checks below. To remove spyware, disconnect from the internet, run a full scan with a reputable anti-malware tool, delete unknown apps and permissions, change your passwords from a different clean device, and if the infection persists, back up your personal files and reinstall the operating system.

Key Takeaways

No single symptom proves spying. Look for a pattern of symptoms.
Both Windows and macOS include built-in tools that reveal suspicious apps, connections and permissions.
Always change your passwords from a different, trusted device when you suspect monitoring.
If you are in an abusive or controlling relationship, read the safety section before you remove anything.
A clean reinstall of the operating system is the most reliable way to eliminate persistent spyware.

What Is Spyware and Who Uses It?

Spyware is software that secretly gathers information about you or your activity and sends it to someone else. It is designed to stay hidden. Unlike a noisy virus that crashes your system, good spyware tries to keep your machine working normally so you never look for it.

Spying tools generally fall into a few categories:

Keyloggers record every key you type, including passwords, messages and search terms.
Screen recorders capture screenshots or video of what you are doing at regular intervals.
Remote access tools (RATs) give another person control of your computer, including files, the webcam and the microphone.
Stalkerware is spyware marketed to individuals, often partners or family members, to track location, messages, browsing history and activity.
Employee monitoring software is legitimate in many workplaces, but it can cross a line if it is installed on personal devices or used without disclosure.
Infostealers and banking trojans are criminal tools that harvest saved passwords, browser cookies, and financial data.
Adware and tracking software bundle with free downloads and track your browsing habits for advertising, sometimes going far beyond what you agreed to.

The people behind them vary. Cybercriminals want money and credentials. Abusive partners want control and information. Corporate or industrial spies want trade secrets. Some employers monitor company laptops legally, and in many cases you were told in your employment agreement. The key question is always whether you know about it and agreed to it.

The 12 Signs of Spyware on Your Computer

No single symptom confirms an infection, because normal wear, full storage or an overdue update can cause many of them. What matters is whether several signs appear together, especially if they started suddenly.

1. Sudden slow performance

Spyware runs in the background, using CPU, memory and disk. If your computer used to be fast and now takes minutes to open a program that is worth investigating. Pay attention if the slowdown began around the same time as you installed new software, clicked a suspicious link or let someone else use your device.

2. Overheating and constant fan noise

A computer that is idle should be quiet. If the fans spin up while you are not doing anything demanding, something is working hard behind the scenes. Cryptominers and screen-recording spyware are common culprits.

3. The webcam light turns on unexpectedly

Most webcams have an LED that lights up whenever the camera is active. If it flashes or glows when you have no video call open, a program is accessing your camera. Not every spyware tool triggers the light, and some cameras can be accessed without it, so a missing light is not proof of safety.

4. The microphone indicator appears when you are not recording

Windows and macOS both show a microphone indicator when an app is listening. If that icon appears and you are not on a call, dictating or recording, find out which app is using it.

5. Unusual network activity

Spyware has to send what it collects somewhere. High upload traffic while your computer is idle, or connections to unfamiliar servers, can reveal this. We cover how to check this in a later section.

6. Unknown programs, processes or browser extensions

Open your list of installed apps and browser extensions. If you see names you do not recognize, especially ones with generic or system-sounding names, investigate each one. Spyware often disguises itself as a system utility.

7. Security software is disabled or keeps turning off

Many spyware programs attempt to disable antivirus tools or firewalls so they can run undisturbed. If your protection turns off by itself, or you cannot turn it back on, treat that as a serious warning.

8. Strange pop-ups, redirects or a changed homepage

Browser hijackers and adware-style spyware alter your search engine, homepage or new tab page. If searches redirect to unfamiliar sites, or you see ads in places they should not appear, your browser may be compromised.

9. Accounts show unusual activity

Password reset emails you did not request, login alerts from new locations, messages you did not send, or sudden changes to account recovery details can all mean someone has your credentials. Keyloggers are a common source.

10. Files, windows or the cursor move on their own

If the cursor jumps, windows open and close, or files appear and disappear without your input, someone may be controlling your computer remotely. Rule out a faulty mouse or a stuck key first, but do not dismiss it.

11. Battery drains much faster than normal

Background processes consume power. A battery that suddenly lasts half as long as before can be a sign of constant background activity, though aging batteries are also a common cause.

12. Your computer shuts down or restarts oddly

Unexpected reboots, a delay in shutting down, or the screen waking from sleep without you touching it can all be side effects of software running behind the scenes.

Remember: these symptoms have many innocent explanations. Treat them as a reason to investigate, not as proof. The sections below show you how to confirm or rule out spyware properly.

How Spyware Gets Onto a Computer

Understanding how monitoring software gets installed helps you work out who may have put it there and how to prevent it happening again.

Phishing emails and malicious attachments. Fake invoices, shipping notices and urgent account alerts trick people into opening an attachment or clicking a link that installs malware.

Bundled software. Free programs, cracked software, pirated games and some browser toolbars bundle spyware inside the installer. Skipping through installer screens without reading them is how many people end up with unwanted extras.

Malicious websites and fake updates. Pop-ups claiming your browser, Flash or video player is out of date can deliver malware. Real updates come from your operating system or the official app, not a random web page.

Fake apps and browser extensions. A tool that promises to speed up your computer, block ads or download videos can be a front for data collection.

Physical access. Many stalkerware and keylogger tools are installed by someone who had your unlocked computer for a few minutes. Hardware keyloggers, small devices placed between the keyboard cable and the computer, also exist, though they are less common.

Weak or reused passwords and remote access. If someone knows your password, they may log in remotely, enable remote desktop, or sign in to your cloud account and sync a monitoring tool.

Shared or managed accounts. Work or school computers are often managed with legitimate monitoring tools. That is different from covert spyware, but you should still know what is installed.

How to Check Windows for Spyware

Work through these steps in order. They move from quick checks to deeper inspection.

Step 1: Check Task Manager for suspicious processes

Press Ctrl + Shift + Esc to open Task Manager.
Click the Processes tab and sort by CPU, Memory, Disk and Network.
Look for processes that use a lot of resources while you are idle, or that have unfamiliar names.
Right-click a suspicious process and choose Open file location. Legitimate Windows files normally live in the Windows or Program Files folders. A process running from a temporary folder, the Downloads folder, or a randomly named folder deserves closer attention.
Search the process name online alongside the word “legitimate” or “malware” before you end or delete anything. Some names look odd but belong to real drivers.

Step 2: Review installed apps

Open Settings > Apps > Installed apps.
Sort by install date to see what was added recently.
Look for programs you do not recall installing, especially remote access tools, “parental control” or “employee monitoring” software, and anything with a vague name.
Uninstall suspicious entries, but make a note of the names first so you can check them again after a scan.

Step 3: Check startup programs

Spyware wants to run every time you start your computer, so it adds itself to startup.

In Task Manager, open the Startup apps tab.
Review each item with a status of Enabled.
Disable anything you do not recognize or need.

For a deeper look, Microsoft’s free Autoruns tool from Sysinternals lists every program, driver and scheduled task that launches at startup. It is powerful, so research entries before you remove them.

Step 4: Check scheduled tasks and services

Press Windows + R, type taskschd.msc and press Enter to open Task Scheduler.
Browse the Task Scheduler Library for tasks you do not recognize.
Press Windows + R, type services.msc and review the list of services for strange names or descriptions.

Step 5: Check remote access settings

A common way someone controls a computer is through built-in or third-party remote tools.

Open Settings > System > Remote Desktop and make sure it is turned off unless you deliberately use it.
Look for remote access software in your installed apps, such as AnyDesk, TeamViewer, VNC or similar. These are legitimate tools, but they should only be there if you installed them.
Check Settings > Accounts > Other users and look for local accounts you did not create.

Step 6: Check whether the device is managed

If you see the message “Some settings are managed by your organization” in Settings, your device is enrolled in management. That is normal for a work or school laptop, but unexpected on a personal computer. Open Settings > Accounts > Access work or school to see whether an organization account is connected.

Step 7: Run Microsoft Defender Offline scan

The built-in Microsoft Defender Antivirus is capable and free.

Open Windows Security > Virus & threat protection.
Click Scan options.
Select Microsoft Defender Antivirus (offline scan) and click Scan now.

The computer restarts and scans before Windows fully loads, which helps catch spyware that hides while Windows is running. Follow this with a full scan and a scan from a second reputable anti-malware tool, because no single product catches everything.

How to Check a Mac for Monitoring Software

Macs are often believed to be immune to spyware. They are not. macOS has strong built-in protections, but stalkerware, adware and remote access tools do exist for it.

Step 1: Check Activity Monitor

Press Command + Space, type Activity Monitor and press Return.
Review the CPU, Memory, Network and Disk tabs.
Look for processes with odd names that use significant resources while you are idle.
Double-click a process and choose Open Files and Ports or look up its location to understand what it is.

Step 2: Review privacy permissions

This is one of the most useful checks on a Mac, because spying tools usually need special permissions to work.

Open System Settings > Privacy & Security.
Review each of these categories and remove apps you do not recognize or no longer need:
- Screen Recording (an app with this permission can capture your screen)
- Accessibility (can control the computer and monitor input)
- Input Monitoring (can record keystrokes)
- Full Disk Access (can read almost all your files)
- Camera and Microphone
- Automation

A legitimate video conferencing app needs camera and microphone access. A mysterious utility asking for Screen Recording, Accessibility and Input Monitoring together is a major red flag.

Step 3: Check login items and background items

Go to System Settings > General > Login Items.
Review both Open at Login and Allow in the Background.
Remove or disable anything unfamiliar.

Step 4: Check profiles and device management

Configuration profiles can control settings and install monitoring tools.

Open System Settings > General > Device Management (or Profiles on some versions).
If you see a profile you did not install on a personal Mac, investigate it. Remove it only if you are sure it is not required by your employer or school.

Step 5: Check the Sharing settings

Open System Settings > General > Sharing.
Make sure Screen Sharing, Remote Management and Remote Login are off unless you set them up.

Step 6: Inspect launch agents and daemons

This is a more advanced step. Persistent software on a Mac often installs property list files in these folders:

~/Library/LaunchAgents
/Library/LaunchAgents
/Library/LaunchDaemons

In Finder, choose Go > Go to Folder and paste each path. Look for files named after apps you do not recognize. Do not delete system files you are unsure about. Search the file name first.

Step 7: Scan with reputable anti-malware software

Run a scan with a trusted Mac security tool and review the results carefully. Combine this with the manual checks above, since stalkerware is sometimes classed as a “potentially unwanted program” rather than outright malware.

How to Check Your Webcam and Microphone

Webcam and microphone spying is the scenario people fear most, so check it directly.

On Windows:

Open Settings > Privacy & security > Camera.
Review the list of apps and turn off access for any you do not recognize. Check the Microphone page the same way.
Newer versions of Windows show which apps recently used the camera or microphone.

On Mac:

Look for the green dot in the menu bar, which means the camera is active, and the orange dot, which means the microphone is in use.
Click Control Center while the dot is visible to see which app is responsible.
Review System Settings > Privacy & Security > Camera and Microphone for unknown apps.

Practical protections:

Use a sliding webcam cover. It is cheap and effective for the camera, though it does not stop audio recording.
Disable the microphone in system settings when you are not using it.
Use a headset with a physical mute switch for sensitive calls.
Remember that a camera LED is not a guarantee. Treat it as one clue among many.

How to Spot Suspicious Network Activity

Spyware that records your activity must send it out. Checking your network connections can reveal where your data is going.

On Windows

Open Command Prompt or Windows Terminal as administrator.
Run netstat -ano to list active connections and the process ID (PID) behind each.
Match each PID in Task Manager (enable the PID column under the Details tab) to see which program is making the connection.
Open Resource Monitor (search for it in the Start menu), go to the Network tab and look at which processes are sending data.

You can also open Settings > Network & internet > Data usage to see which apps are using the most data.

On Mac

Open Terminal and run lsof -i -P | grep ESTABLISHED to list active network connections and the programs that own them.
Use the Network tab of Activity Monitor to see which processes send the most data.
Consider a network monitoring tool that alerts you each time an app tries to connect to the internet. These tools make unexpected outbound connections very easy to spot.

What to look for

Apps you do not recognize making outbound connections
Large amounts of upload data while you are idle
Connections to unfamiliar foreign IP addresses at odd hours
Repeated, regular connections that look like a “heartbeat”

Not every unfamiliar connection is malicious, because operating systems and apps talk to many cloud services. Search the process and the destination before you panic.

Check Your Browser, Accounts and Router

Spying does not always happen on the computer itself. Check these other places too.

Browser extensions

In Chrome, Edge, Firefox or Safari, open the extensions page and remove anything you do not recognize or no longer use. Extensions can read every page you visit, so a malicious one is effectively a spy inside your browser. Also check your default search engine, homepage and any unfamiliar saved site permissions.

Account security

Review the recent activity and active sessions of your most important accounts: email, Apple ID or Microsoft account, Google account, banking, and social media.

Look for unfamiliar devices and locations
Check email forwarding rules and filters, since attackers often add one to silently copy your mail
Review connected apps and third-party access
Sign out of all sessions, then sign back in

A stolen password can give someone the same visibility as spyware, without any software on your computer at all.

Cloud sync and backups

If someone has your Apple ID, Google or Microsoft login, they may be able to see your backups, messages, photos or location from their own device. Change that password and enable two-factor authentication.

Your router and Wi-Fi

Log in to your router’s admin page and check the list of connected devices.
Change the router admin password from the default.
Update the router firmware.
Use WPA3 or WPA2 encryption with a strong Wi-Fi password.
Disable remote management unless you need it.

An unfamiliar device on your network is not necessarily spyware, but it tells you someone else has your Wi-Fi password.

Safety Warning: If You Are Being Stalked or Controlled

If you suspect that a partner, ex-partner or family member is monitoring you, take extra care. Removing stalkerware can alert the person who installed it, and in some situations that can escalate to confrontation or danger.

Use a safe device that the other person has never touched, such as a computer at a library, a trusted friend’s phone or a new device, to research help and change passwords.
Do not delete anything straight away if you feel unsafe. Consider documenting what you find with screenshots taken from a safe device.
Reach out to specialists. In the United States, the National Domestic Violence Hotline (1-800-799-7233, or text START to 88788) can help with safety planning, including technology safety. The Coalition Against Stalkerware and local domestic violence organizations offer guidance in many countries.
Think about your phone as well as your computer. Stalkerware is more common on phones, and the same person who monitors your computer may be monitoring your phone, car or accounts.
If you are in immediate danger, contact your local emergency number.

Stalking and covertly installing monitoring software on another adult’s device is illegal in many places. Keep records and consider speaking to a lawyer or a victim support service.

How to Remove Spyware Step by Step

Once you have confirmed or strongly suspected monitoring software, work through the process below in order.

Step 1: Use a clean device to protect your accounts first

Before you do anything on the affected machine, use a separate, trusted device to change the passwords for your email, banking, cloud and social accounts. If a keylogger is running, any password you type on the infected computer is going straight to the spy. Turn on two-factor authentication, ideally with an authenticator app or a hardware security key rather than SMS.

Step 2: Disconnect from the internet

Turn off Wi-Fi and unplug the Ethernet cable. This cuts off the spyware’s connection to whoever is receiving your data and prevents it from downloading additional components.

Step 3: Back up only what you need

Copy essential personal files, such as documents and photos, to an external drive. Avoid backing up applications and system files, because they may carry the infection with them. Scan the backup later before restoring anything.

Step 4: Boot into Safe Mode

Safe Mode loads only the essentials, which prevents many spyware programs from starting.

Windows: Hold Shift while clicking Restart, choose Troubleshoot > Advanced options > Startup Settings > Restart, then press 4 or 5 for Safe Mode (with networking only if you need to download tools).
Mac (Apple silicon): Shut down, then press and hold the power button until startup options appear. Select your disk, hold Shift, and click Continue in Safe Mode.
Mac (Intel): Restart and hold Shift until the login window appears.

Step 5: Uninstall suspicious software

Remove unknown programs through Settings > Apps on Windows, or by dragging them to the Trash and clearing leftover login items and launch agents on Mac. Remove malicious browser extensions and reset your browser settings.

Step 6: Run full anti-malware scans

Scan with at least two reputable tools. Quarantine or remove everything flagged. Reboot and scan again to confirm nothing returns. If you are using Windows, include the Microsoft Defender Offline scan described earlier.

Step 7: Update everything

Install all pending operating system updates, browser updates and app updates. Many spyware tools rely on outdated software with known vulnerabilities.

Step 8: Reset permissions and accounts

Remove any unknown user accounts
Revoke app permissions for screen recording, camera, microphone and accessibility
Delete unknown profiles
Sign out of all sessions on your important accounts

Step 9: Consider a clean reinstall

If the spyware keeps returning, if you cannot identify what is running, or if you handle sensitive information, the surest solution is to wipe the disk and reinstall the operating system.

Windows: Go to Settings > System > Recovery > Reset this PC and choose Remove everything. For a thorough result, download the Windows installation media on a clean computer and do a fresh install.
Mac: Use Erase All Content and Settings on supported Macs, or boot into macOS Recovery, erase the disk with Disk Utility and reinstall macOS.

Restore your files from your scanned backup, and reinstall your apps only from official sources. Do not restore a full system backup that might contain the spyware.

Step 10: Watch for signs of reinfection

For the next few weeks, monitor your performance, network activity and account alerts. If suspicious behavior comes back after a clean install, the problem may lie elsewhere: a compromised router, a stolen account password, firmware-level malware or a hardware device such as a keylogger. At that point, consider professional help from an IT security specialist.

When to Call a Professional

Get expert help if:

You handle confidential client, medical, legal or financial data
You suspect a targeted attack by someone with technical skills
Spyware returns after a full reinstall
You are in a legal dispute or abusive situation and may need evidence preserved properly
Your business network may be affected

A digital forensics or cybersecurity professional can examine the device without destroying evidence, which matters if you plan to involve the police or a court.

How to Prevent Spyware in the Future

Prevention is easier than cleanup. These habits dramatically lower your risk.

Lock your computer with a strong password or passphrase and set it to lock automatically when you step away. Most stalkerware requires physical access.
Use unique passwords for every account and store them in a reputable password manager.
Turn on two-factor authentication everywhere it is offered.
Keep your operating system and apps updated. Enable automatic updates.
Download software only from official sources, such as the Microsoft Store, the Mac App Store or the developer’s own website. Avoid cracked software and pirated downloads.
Think before you click. Treat unexpected attachments, urgent messages and “your computer is infected” pop-ups as suspicious.
Use a standard account for daily activity rather than an administrator account, so installing software requires an extra password.
Keep the firewall on and use a trusted security tool with real-time protection.
Review app permissions regularly, especially camera, microphone, screen recording and accessibility access.
Secure your router with a strong admin password, current firmware and encrypted Wi-Fi.
Encrypt your drive using BitLocker on supported Windows editions or FileVault on Mac, which protects your data if the device is lost or stolen.
Back up regularly to an offline or separate location so you can recover quickly after any infection.

Is It Illegal to Spy on Someone’s Computer?

In most places, secretly installing monitoring software on another adult’s personal device without their consent is illegal. Laws vary by country and region, but unauthorized access, interception of communications and stalking statutes commonly apply.

There are legitimate exceptions. Employers may monitor company-owned devices and accounts, usually with a disclosed policy. Parents may use parental controls on their minor children’s devices, ideally with the child’s knowledge and age-appropriate transparency. The line is crossed when monitoring is hidden, nonconsensual and aimed at an adult’s personal life. If you believe this has happened to you, speak with a legal professional or local authorities. This article is general information, not legal advice.

Frequently Asked Questions

Can someone spy on my computer without me knowing?

Yes. Well-designed spyware is built to run silently and avoid detection. It may not slow your computer noticeably or show an icon. That is why you should check permissions, startup items, network connections and account activity rather than relying on how your computer feels.

How do I know if my webcam is being hacked?

Watch for the camera LED turning on when you are not using the camera, unknown apps in your camera permission list, and the green indicator dot on a Mac. Check your privacy settings, scan for malware and cover the lens when you are not using it. Remember that some malware can access the camera without activating the light.

Does a factory reset remove spyware?

In most cases, yes. Wiping the drive and reinstalling the operating system removes nearly all spyware. Rare exceptions include firmware-level infections or spyware that is restored from a compromised cloud backup. After a reset, set up the device as new, use fresh passwords from a clean device, and do not restore from a backup that may be infected.

Can antivirus software detect spyware?

Often, but not always. Antivirus tools are good at known malware and many stalkerware families, but custom or legitimate-looking monitoring software can slip through, because some of it is technically a legal product. Combine automatic scans with manual checks of apps, permissions and network activity.

Can my employer see what I do on my work computer?

Usually yes, if the computer is company-owned. Employers commonly use device management and monitoring tools to track web activity, email and files. Review your company policy, and avoid personal banking, private messages or sensitive personal activity on work devices. Never assume a work computer is private.

Can someone spy on my computer through Wi-Fi?

Someone on the same network may see unencrypted traffic or try to reach insecure devices, and a compromised router can redirect or monitor your activity. Most modern websites use HTTPS, which protects the content of your sessions, but a secure router, strong Wi-Fi encryption and a VPN on public networks add valuable protection.

Will a VPN stop spyware?

No. A VPN encrypts your internet connection, but it does not remove spyware that is already on your computer. A keylogger or screen recorder sees your activity before it ever reaches the VPN.

How do I check for a keylogger?

Look for unknown programs, startup items, and permissions such as Input Monitoring on a Mac. Run anti-malware scans and monitor outbound network connections. Also inspect the back of a desktop computer to make sure no small device sits between the keyboard cable and the USB port, because hardware keyloggers exist.

Is my computer spying on me because I see targeted ads?

Not necessarily. Targeted ads mainly come from cookies, trackers, and your own search and browsing history, not from hidden listening software. Review your ad settings and use privacy-focused browser settings, but do not treat ads alone as proof of spyware.

What should I do first if I think I am being monitored?

Use a different device to change your passwords and enable two-factor authentication. Then disconnect the affected computer from the internet, run scans, and review apps and permissions. If your safety may be at risk, contact a support organization before you remove anything.

Quick Spyware Checklist

Use this list to run a fast self-check:

Task Manager or Activity Monitor shows no unknown, resource-heavy processes
No unfamiliar apps, extensions or user accounts
Startup and login items are all recognizable
Camera, microphone, screen recording and accessibility permissions are limited to trusted apps
Remote Desktop, Screen Sharing and Remote Login are off unless you need them
No unusual outbound network connections
Security software is on and up to date
Your accounts show no unfamiliar logins or forwarding rules
Your router has a strong admin password and no unknown devices
Your operating system and apps are fully updated

Conclusion

The signs of spyware on a computer can be subtle, but they are rarely invisible if you know where to look. Slow performance, odd network traffic, a webcam light that behaves strangely, unfamiliar apps and security tools that switch off by themselves all point toward the same question: is my computer being monitored?

Start with the quick checks in Task Manager or Activity Monitor, review your permissions and startup items, and watch your network connections. Secure your accounts from a clean device, run reputable scans, and remove spyware methodically. If nothing else works, a clean reinstall gives you a fresh start.

Most importantly, if the spying may be coming from someone you know, put your safety first. Reach out to a trusted person or a support organization, and take the time to document what you find.

A few minutes spent checking your system today can protect your privacy, your money and your peace of mind for years to come.