Something on this phone
is talking. We're listening back.

Stalkerware is not a virus. It's a working product, sold openly, marketed as "parental monitoring" or "employee oversight," and installed by someone with physical access to a device: a partner, an ex, an employer. Once running, it reads messages, tracks location, and in some cases listens through the microphone, then quietly uploads what it finds.

That's exactly why signature-based antivirus mostly misses it. A scanner looks for code that shouldn't be there. Stalkerware isn't malicious code by that definition. It's doing precisely what it was installed to do. Nothing about its file signature looks wrong, because nothing about it is broken. It's working as intended, against the person carrying the phone.

There is one thing every app in this category cannot avoid, no matter how well it hides its icon or renames its process: it has to send what it collects somewhere. That outbound connection (to a command server, a collection endpoint, an operator's dashboard) is the one behavior detection doesn't need to know an app's name to catch.

This is also where ENCLAY draws a hard line around what it's for. It does not make you anonymous. It doesn't hide your IP, mask your identity, or route your traffic through anyone else's server. What it does is refuse to let something already on your device reach whoever it's reporting to: protection against intrusion, not a promise of invisibility.