These special phone and app features can help protect you from spyware

Spyware attacks on journalists, human rights defenders, and political opponents are no longer rare or uncommon. In early 2025, WhatsApp notified about 90 users – many of them journalists and members of the public across Europe – that they had been targeted by the Israeli spyware company Paragon Solutions. Months later, Apple sent threat notifications to a new group of iOS users; Forensic analysis confirmed that two of them, both journalists, were hit by Paragon’s Graphite spyware using a zero-click attack, meaning they didn’t have to touch a link to be compromised. These are not isolated incidents. They are normal.

Over the past 15 years, security researchers have documented dozens of incidents in which government hackers have targeted and endangered journalists, human rights defenders, critics and political opponents.

These attacks rely on expensive, sophisticated, and hidden tools that allow their operators to infiltrate and install spyware on computers, but especially smartphones, which carry almost all the data about a person’s daily life.

Spyware gives its operators full access to the target’s device and data. Government spies can record phone calls, steal chat messages, access photos, and turn on a device’s camera and microphone to record ambient sound and record intimate conversations. Spyware also tracks a person’s real-time location.

In response to these attacks, tech giants are now providing their users with better protection. In particular, Apple, Google, and Meta offer logging features designed to counter targeted spyware attacks.

Generally, these features add additional security, sometimes by disabling or limiting certain common features. It’s a tradeoff, but having used them myself for a long time, I’ve never found them too tiring or annoying to use.

Tech companies, security researchers who have studied spyware for years, and us at TechCrunch, recommend using these features if you suspect you may be under government surveillance because of who you are or what you do. Even if you don’t, these security features will keep your data better protected from getting into the wrong hands.

No security measure is perfect, and it’s a continuous effort to keep security flaws at bay. Spyware makers find new ways to hack phones and services, and software makers learn from those attacks and respond. Rinse and repeat.

But that doesn’t mean these features shouldn’t be used. On the contrary; these features have been successfully proven.

“These features are free, easy to enable, and the best defense we have today against sophisticated spyware,” said Runa Sandvik, a security researcher who has worked to protect journalists and other vulnerable communities for more than a decade. “If features get in the way of something you need to do, you can easily turn them off again — which means it costs a lot less money to turn them on and try.”

Here’s an overview of these features, and how to turn them on.

Apple lock mode

Apple’s Lockdown Mode is available on all Apple devices, including iPhones. Apple says that if Lockdown Mode is enabled, “your device will not function as it normally does.” If you exchange this interference, your device will be more secure.

There is evidence that Lockdown Mode has helped in the past. Citizen Lab found that Lockdown Mode stopped one spyware attack by NSO Group’s Pegasus software. As recently as March, Apple said it has never found a successful attack on an Apple device with Lockdown Mode enabled.

This is what changes the Lockdown mode on your device when you turn it on:

• Email attachments received from iMessage other than images, video, and audio are automatically blocked.
• Links and previews in iMessage are blocked and appear as offline web addresses. (You can copy and paste the links into Safari or another browser if you want.)
• Fonts, some images, and other web technologies are blocked when browsing in Safari.
• Incoming FaceTime calls are blocked if you haven’t contacted that person before or in the last 30 days.
• Screen sharing, content sharing via SharePlay, and Live Photos are not available.
• Incoming invitations to Apple services are blocked unless you have previously invited that person.
• The Focus feature “and any related condition will not work as expected.”
• Game Center is disabled.
• Location information is removed when you share photos.
• “Shared albums are removed from the Photos app, and new invitations to the shared album are blocked.”
• You need to unlock your device to connect it to a device or computer. When connecting a Mac with Apple-made processors to the accessory, the computer needs to be turned on and you must authorize the connection with your passcode.
• You cannot automatically connect to open or public Wi-Fi networks, and you will be disconnected from any unsecured Wi-Fi networks you previously connected to before enabling Lockdown Mode.
• Your phone will not be able to connect to 2G or 3G mobile networks.
• You cannot install configuration profiles or register a device in the Mobile Device Management program.

To turn on Lockdown Mode, go to Settings, then Privacy & Security, and scroll down to Lockdown Mode. Once you enable the feature, your Apple device will restart.

I have been using Lockdown Mode for years. While I realized that some websites were wrong at first, I didn’t realize that for a long time. Also, you can selectively turn off lock mode for certain websites and apps, without disabling the feature entirely. There are quirks, but I’m used to them, too.

Google Advanced Security Program

Google launched its Advanced Security Program in 2017. This feature is designed to make your Google account more resistant to malicious hackers of all kinds.

The Advanced Protection Program includes the following features:

• It restricts other third-party services and applications from accessing your Google account, and only with your permission.
• Enables “Gmail Deep Scan,” which scans your incoming emails for phishing attacks and malicious content.
• It enables Google Safe Browsing in Chrome, which warns users who navigate to dangerous sites or download dangerous files.
• On Android, you can only install apps and games from official app stores.
• When someone tries to log into your account, Google takes extra steps to verify that it’s really you.

To turn on Advanced Protection, go to its official page and click “Start.” This will allow you to sign in to your Google account. Follow the instructions there.

First, you’ll need to add a physical authentication key (or software access key) as an additional authentication factor in addition to your passwords. You’ll also need to add a recovery phone and recovery email to your account, or use a backup passkey or authentication key.

Advanced Security Mode for Android

Introduced last year and likely inspired by Apple’s Lock Mode, Advanced Security Mode for Android brings similar protections to Google’s mobile operating system.

Advanced Security Mode for Android offers the following security features:

• It enables Google Play Protect, which protects against malware and unwanted apps, and checks all apps for “malicious behavior.”
• Apps from unknown sources cannot be installed, and updates from previously installed apps from unknown sources will be prevented from running.
• Enables Memory Tag Extension (MTE) on supported devices. MTE is a hardware-enforced feature that protects against certain types of vulnerabilities.
• The device locks itself when it detects suspicious activity that “indicates theft,” such as sudden and rapid movement. This is based on data from the device’s motion sensors, Wi-Fi, and Bluetooth.
• The device locks automatically if it is offline for a long time.
• The device automatically restarts if the phone is locked for 72 hours, making it difficult to extract data using forensic tools designed to unlock phones, such as devices made by Cellebrite.
• When the device is locked, the USB connection is blocked.
• Google looks for “unsolicited and potentially harmful messages.”
• Links sent through the messaging app from anonymous users will be flagged.
• Connections to 2G networks are blocked.
• Google will identify spam callers.
• You will be able to screen incoming calls and reject spam calls automatically. (Available in certain regions only.)
• Enables Safe Browsing for Android, which protects against malicious websites.
• Chrome will automatically use HTTPS encryption on all sites.
• Some JavaScript functions are disabled, reducing the browser’s attack surface for potential vulnerabilities.
• You can also enable log logging, an optional feature that helps researchers investigate spyware attacks.

To enable Advanced Protection Mode on your Android device, go to Settings, then Security & Privacy, and under Other settings, tap Advanced Protection, then tap Device Protection.

WhatsApp Fixed Account Settings

WhatsApp is used by more than 3 billion people, including those in various government intelligence agencies.

The demand for hacking tools targeting WhatsApp is such a huge demand that exploits can cost millions of dollars – and they work. In 2019, WhatsApp caught a hacking campaign by NSO Group that targeted around 1,200 users. Early last year, WhatsApp caught another spying operation that caught around 90 users in Europe.

In response, earlier this year, WhatsApp introduced Strong Account Settings, a login feature that changes privacy and security controls based on operating system.

On Android and iOS, Strong Account Settings enable the following features:

• Two-step verification.
• Security alerts, which alert users if a contact has changed their phone or reinstalled WhatsApp, or if an attacker takes control of their account.
• Blocks email attachments and media (photos and videos) from unknown senders automatically.
• Link preview is disabled.
• Calls from unknown numbers are muted.
• Your IP address is hidden from calls.
• Your profile and activity information, such as when you were last seen online, your profile picture, and information about yourself, are hidden from people other than your contacts or pre-established group members.
• Only contacts or members of a previously established group can add you to a group chat.

To turn on the feature, use your primary device and go to Settings, then Privacy, then scroll down to Advanced and turn it on.