These special phone features and apps can help protect you from spyware

Spyware attacks on journalists, human rights defenders and political dissidents are no longer rare or unusual. In early 2025, WhatsApp informed nearly 90 users – many of them journalists and members of civil society across Europe – that they had been targeted by Israeli spyware company Paragon Solutions. Months later, Apple sent threat notifications to a new group of iOS users; Forensic analysis confirmed that two of them, both journalists, were attacked by Paragon’s Graphite spyware using a zero-click attack, meaning they did not even have to click on a link to be compromised. These are not isolated incidents. They are Al Qaeda.

Over the past 15 years, security researchers have documented countless cases in which government hackers have targeted and successfully compromised journalists, human rights defenders, critics, and political opponents.

These attacks rely on expensive, sophisticated and hidden tools that allow their operators to hack and install spyware on computers, especially smartphones, which contain almost all the data related to a person’s daily life.

Spyware gives its operators almost complete access to the target’s device and data. Government spies can record phone calls, steal chat messages, access photos, turn on the device’s camera and microphone to record ambient sound, and record nearby conversations. Spyware also usually tracks a person’s location in real time.

In response to these attacks, tech giants are now providing their users with better defenses. In particular, Apple, Google, and Meta provide subscription features specifically designed to counter targeted spyware attacks.

In general, these features add extra protection, sometimes by turning off or restricting some regular features. It’s a trade-off, but having used it myself for so long, I’ve never found it too cumbersome or annoying to use.

Tech companies and security researchers who have studied spyware for years, and we at TechCrunch, recommend you use these features if you suspect you may be a target of government surveillance because of who you are or what you do. Even if you’re not, these security features will keep your data better protected from falling into the wrong hands.

No security measure is perfect, it is a continuous effort to keep security flaws at bay. Spyware makers find new ways to compromise phones and services, and then software makers learn from and respond to those attacks. Rinse and repeat.

But that doesn’t mean these features aren’t worth using. on the contrary; These features have proven effective.

“These features are free, easy to enable, and are the best defense we have today against sophisticated spyware,” said Rona Sandvik, a security researcher who has worked to protect journalists and other vulnerable communities for more than a decade. “If features get in the way of something you need to do, you can easily turn them off again – meaning it costs very little to turn them on and try them out.”

Here’s a summary of these features and how to turn them on.

Apple lock mode

Apple’s Lockdown Mode is available on all Apple devices, including iPhones. Apple says that when Lock Mode is enabled, “your device will not function as it normally does.” In exchange for this inconvenience, your device will be more secure.

There is evidence that insurance status has helped in the past. Citizen Lab discovered that Lockdown Mode stopped a spyware attack carried out using NSO Group’s Pegasus software. In March, Apple said it had never detected a successful attack on an Apple device with Lockdown Mode enabled.

This is what Lock Mode changes on your device when you turn it on:

• Attachments received on iMessage other than some photos, video, and audio are blocked by default.
• Links and previews are blocked in iMessage and appear as unlinked web addresses. (You can copy and paste the links into Safari or another browser if you like.)
• Fonts, some images, and some web technologies are blocked when browsing in Safari.
• Incoming FaceTime calls are blocked if you haven’t contacted that person before or within the past 30 days.
• Screen sharing and content sharing via SharePlay and Live Photos are not available.
• Invitations to Apple services are blocked unless you’ve previously invited that person.
• Focus feature and any related status will not work as expected.
• Game Center is disabled.
• Location information is stripped when sharing photos.
• “Shared albums are removed from the Photos app, and invitations to new shared albums are blocked.”
• You need to unlock your device to connect it to an accessory or to a computer. When you connect a Mac with Apple-made processors to an accessory, the computer must be unlocked and you must approve the connection using your passcode.
• You can’t automatically connect to open or public Wi-Fi networks, and you’ll be disconnected from any unsecured Wi-Fi networks you previously connected to before enabling Lock Mode.
• Your phone will not be able to connect to 2G or 3G cellular networks.
• You cannot install configuration profiles or register the device in mobile device management software.

To turn on Lock mode, go to Settings, then Privacy & Security, and scroll down to Lock mode. Once the feature is enabled, your Apple device will restart.

I’ve used Lockdown mode for years. Although I noticed that some of the websites were a little wonky at first, I haven’t noticed that in a while. You can also turn off Lock Mode selectively for specific websites and apps, without disabling the feature entirely. There are some quirks, but I’m used to them too.

Google Advanced Protection Program

Google launched its Advanced Protection program in 2017. This feature was designed to make your Google account more resilient against malicious hackers of all kinds.

Advanced Protection includes the following features:

• Some third-party services and apps restrict access to your Google Account, only with your permission.
• Enable Gmail Deep Scan, which scans incoming emails for phishing attacks and malicious content.
• Enables Google Safe Browsing in Chrome, which warns users about going to dangerous sites or downloading dangerous files.
• On Android, you can only install apps and games from legitimate app stores.
• If someone tries to sign in to your account, Google takes extra steps to verify it’s actually you.

To turn on advanced protection, go to its official page and click “Get Started”. This will prompt you to sign in to your Google account. Follow the instructions there.

First, you’ll need to add a physical security key (or software passkey) as an additional verification factor apart from your passwords. You’ll also need to add a recovery phone and recovery email to your account, or use a backup passkey or security key.

Advanced sandbox for Android

Android’s Advanced Sandbox was introduced last year and was likely inspired by Apple’s Lockdown Mode, offering similar defenses to Google’s mobile operating system.

Android Advanced Security Mode provides the following security features:

• Enables Google Play Protect, which protects against malware and unwanted apps, and scans all apps for “malicious behavior.”
• Apps cannot be installed from unknown sources, and updates from pre-installed apps from unknown sources will be blocked from running.
• To enable Memory Tagging Extension (MTE) on supported devices. MTE is a hardware-enforced feature that protects against certain types of vulnerabilities.
• The device automatically locks if it detects suspicious “theft” activity, such as sudden, rapid movement. This is based on data from the device’s motion sensors, Wi-Fi, and Bluetooth.
• The device automatically locks if the Internet connection is interrupted for a long period.
• The device automatically reboots if the phone is locked for 72 hours, making it difficult to extract data using law enforcement tools designed to unlock phones, such as devices made by Cellebrite.
• When the device is locked, USB connections are blocked.
• Google searches for “spam and potentially harmful messages.”
• Links sent via the Messages app from unknown users will be flagged.
• Connection to 2G networks is blocked.
• Google will identify spam callers.
• You will be able to screen incoming calls and reject unwanted calls automatically. (Only available in certain regions.)
• Enable Safe Browsing for Android, which protects against malicious websites.
• Chrome will automatically enforce HTTPS encryption on all sites.
• Some JavaScript functions are turned off, reducing the browser’s attack surface for potential vulnerabilities.
• You can also enable intrusion logging, an optional feature that helps researchers investigate spyware attacks.

To enable Advanced Security mode on your Android device, go to Settings, then Security & Privacy, under Other settings, tap Advanced Protection, and then tap Device protection.

Strict WhatsApp account settings

WhatsApp is used by more than 3 billion people, including those in the crosshairs of resourceful government agencies.

The demand for hacking tools targeting WhatsApp is so high that exploits can cost millions of dollars – and they work. In 2019, WhatsApp discovered a hacking campaign by NSO Group that targeted around 1,200 users. Early last year, WhatsApp discovered another spying operation that implicated around 90 users in Europe.

In response, earlier this year, WhatsApp launched Strict Account Settings, an opt-in feature that turns on some privacy and security controls depending on the operating system.

On Android and iOS, strict account settings turn on the following features:

• Two-step verification.
• Security notifications, which alert users when a contact changes their phone or reinstalls WhatsApp, or if an attacker takes control of their account.
• Blocks attachments and media (photos and videos) from unknown senders by default.
• Link previews have been disabled.
• Incoming calls from unknown numbers are silenced.
• Your IP address is hidden in calls.
• Your profile information and activities, such as when you were last seen online, your profile picture, and about information, are hidden from people who are not your contacts or members of a previously created group.
• Only pre-selected contacts or group members can add you to the group chat.

To turn the feature on, use your primary device and go to Settings, then Privacy, then scroll down to Advanced and turn it on.