She always felt her ex-boyfriend was tracking her—then she checked her phone: an app with no icon had been uploading data for 5 months

A netizen used Claude Code to check his sister's Android phone and found a hidden app called “System Service.” It had no icon, did not come from the Play Store, and had been installed for 5 months. Every 15 minutes it uploaded location, messages, and call logs to a server in the Netherlands. The most recent upload was 11 minutes earlier.

His sister had thought her ex-boyfriend was just being overly sensitive—until this check.

The process wasn’t complicated: enable USB debugging on the phone, connect it to a MacBook, and run Claude Code. It found a package with no launcher icon, package name com.sys.***.service, installed manually via APK. In other words, someone had gotten hold of her unlocked phone for about 2 minutes. That’s all the time this kind of app needs.

It had requested the following permissions:

Accessibility service (can read everything on the screen)
Notification access (preview of every app notification)
Device administrator (cannot be uninstalled through normal means)
Location, microphone, call logs, SMS

Google Play Protect had been turned off. She didn’t turn it off. This is the first step after this type of app is installed.

This kind of incident is not isolated. According to Kaspersky, more than 31,000 people were affected by stalkerware in 2023 alone. And this type of software is often installed only after someone close to you has briefly gotten hold of your phone.

What was done that night:

First take screenshots to preserve all evidence, in case it is needed later.
Revoke device administrator permission, then uninstall the app.
Re-enable Play Protect and run a full scan.
Use another phone to change the Google password and all other passwords.
Set a new lock-screen PIN and do not tell anyone.

The video records the screen output when the phone was connected to the computer.

If you want to check your own phone:

Go to Settings and review all apps, paying attention to items with no icon or suspicious names.
Make sure Play Protect is on and that installation from “unknown sources” is disabled.
If your phone has ever briefly left your possession, do not ignore it.
After finding a suspicious app, first preserve evidence, then change passwords from another device.

The whole check took about 3 minutes. She didn’t cry; she just went silent for a long time, then asked, “How long?” The answer was 5 months.

In this case, the thing that found the problem was Claude Code. But its work looked simple: following instructions, it found something that should not exist. What is truly unsettling is this: installation took only 2 minutes, while discovery took 5 months. Technology can help us find it, but by then it is often too late.