Skip to content
Syn_OS Phoenix Syn_OS

Spyware

Risk Level

Introduction

Section titled “Introduction”

Spyware secretly monitors user activity and collects sensitive information — passwords, credit cards, browsing history, keystrokes — without knowledge or consent. Data is transmitted to third parties for fraud, identity theft, espionage, or surveillance.

History

Section titled “History”
MilestoneYearDetails
Term coined1995Usenet post
Commercial spyware boomEarly 2000sBundled with adware
Pegasus revealed2016NSO Group; zero-click iOS/Android spyware
State-sponsored2013+Snowden revelations; government-grade

How It Works

Section titled “How It Works”
1. INSTALLATION
   └─ Bundling, drive-by download, phishing, browser exploit


2. PERSISTENCE
   └─ Registry, scheduled tasks, browser extensions


3. DATA COLLECTION
   └─ Keystrokes, screenshots, clipboard, form data


4. CREDENTIAL HARVESTING
   └─ Browser API hooks → saved passwords, session cookies


5. EXFILTRATION
   └─ Encrypted C2 channel to operator

Notable Examples

Section titled “Notable Examples”
SpywareYearTargetImpact
CoolWebSearch2003Browser hijackRedirects, data theft
Gator/eZula2000sAdware/spywareBundled installs
FinFisher2011+Gov/LECommercial surveillance
Pegasus2016+Journalists, activistsZero-click iOS/Android
DarkHotel2014+Hotel Wi-FiBusiness travellers

Prevention

Section titled “Prevention”
  • ✅ Only install from official sources
  • ✅ Review app permissions — deny camera/mic/location
  • ✅ Keep OS and apps updated
  • ✅ Anti-malware with spyware detection
  • ✅ Browser privacy extensions (uBlock, Privacy Badger)
  • ✅ Encrypted DNS (DoH/DoT)
  • ✅ High-risk: GrapheneOS on Pixel hardware

MITRE ATT&CK

Section titled “MITRE ATT&CK”
TechniqueIDDescription
KeyloggingT1056.001Keystroke capture
Screen CaptureT1113Screenshot recording
Credentials from Password StoresT1555Browser password theft
Exfiltration Over Web ServiceT1567Cloud storage exfil
Section titled “Related”