404 Media shows stalkerware becoming a subscription model for domestic control

In a conversation published by 404 Media, Joseph talks with Zack Whittaker about stalkerware: malicious software that is not sold as a state weapon or a criminal gang’s toolkit, but as a practical way to monitor a partner’s phone. That is what makes the issue so blunt. The technology can look ordinary, while the consequence is intensely personal: location, messages, calls, photos, and routines can become instruments of control.

Stalkerware differs from the standard image of malware because the attacker is often not an unknown figure somewhere else. It can be a partner, an ex-partner, or someone who already has physical access to the device, the passcode, the account, or the household’s digital setup. That is why this story cannot be reduced to “install security software.” It is a security problem sitting between cyber defense, domestic abuse, privacy, and law.

Whittaker has long reported on the stalkerware industry and data exposures tied to these services. Broader documentation from the Coalition Against Stalkerware shows why this is a distinct threat category: apps can be hidden, marketed under neutral names, or framed as parental-control tools, while in practice being used to monitor adults without consent. The Electronic Frontier Foundation also warns that technical removal is not always the first safe move, because the person watching the device may notice the change.

The central point is not only that this software exists, but that its user model is built for “ordinary” buyers. Surveillance is packaged into subscriptions, dashboards, and promises of access, lowering the threshold for abuse. When a tool does not require technical skill, only access to a phone and a motive for control, the harm expands far beyond the traditional cybersecurity audience.

Regulatory pressure exists, but it has not closed the space. The U.S. Federal Trade Commission has already penalized and banned specific spyware operators, yet the market can rename itself, restructure, and return with new claims. Platforms matter too: Apple and Google can make distribution harder, but the problem often begins with physical access, compromised accounts, or sideloaded apps outside official stores.

That is why public advice about stalkerware has to be precise. It is not enough to tell people to “protect their privacy.” A victim may not have a safe second device, may share family accounts, or may be unable to change passwords without triggering consequences. Good security guidance in this context needs a safety plan: checking a device in a safe setting, contacting specialist support, documenting abuse where safe, and separating accounts only when the person controls a secure communication channel.

404 Media frames the story where it belongs: in society, not only in technology. Stalkerware is a reminder that digital privacy is not lost only in major data breaches. Sometimes it disappears quietly, on your own phone, through an app installed by someone who already knows where you sleep.