TL;DR: Check for unfamiliar configuration profiles, unexpected battery drain, and the device feeling warm when idle — genuine iOS spyware is rare and usually requires either a compromised profile or, in targeted cases, a sophisticated exploit rather than a simple app install. Go to Settings > General > VPN & Device Management and remove any unrecognized profile, update to the latest iOS version immediately since updates patch known exploits, and if you believe you're a high-risk target, use Settings > Privacy & Security > Lockdown Mode for stronger protection; a full Erase All Content and Settings reset removes essentially all known spyware.
Check for unfamiliar configuration profiles, unexpected battery drain, and the device feeling warm when idle — genuine iOS spyware is rare and usually requires either a compromised profile or, in targeted cases, a sophisticated exploit rather than a simple app install.
What Usually Causes This
Because Apple restricts direct file-system access, spyware on iPhone typically arrives via a malicious configuration profile the user was tricked into installing, or in rare high-value-target cases via a zero-click vulnerability later patched by Apple.
What to Do About It
Go to Settings > General > VPN & Device Management and remove any unrecognized profile, update to the latest iOS version immediately since updates patch known exploits, and if you believe you're a high-risk target, use Settings > Privacy & Security > Lockdown Mode for stronger protection; a full Erase All Content and Settings reset removes essentially all known spyware.
If this looks similar to something else you've seen, it's worth reading How to Secure a Home Security Camera System.
This pattern shows up elsewhere too — see How to Secure a Shared Family Computer.
Frequently Asked Questions
What are the real warning signs?
Check for unfamiliar configuration profiles, unexpected battery drain, and the device feeling warm when idle — genuine iOS spyware is rare and usually requires either a compromised profile or, in targeted cases, a sophisticated exploit rather than a simple app install.
What usually causes this?
Because Apple restricts direct file-system access, spyware on iPhone typically arrives via a malicious configuration profile the user was tricked into installing, or in rare high-value-target cases via a zero-click vulnerability later patched by Apple.
What should I do about it?
Go to Settings > General > VPN & Device Management and remove any unrecognized profile, update to the latest iOS version immediately since updates patch known exploits, and if you believe you're a high-risk target, use Settings > Privacy & Security > Lockdown Mode for stronger protection; a full Erase All Content and Settings reset removes essentially all known spyware.
Should I be worried if I only see one sign?
One sign alone (like a slower device) is usually not cause for alarm — most single symptoms have mundane explanations. Multiple signs together, especially unexpected data usage or unfamiliar apps, are worth investigating.