Surveillance malware is malicious code built to quietly watch a device instead of destroying it. It may record keystrokes, capture screenshots, steal messages, collect credentials, enumerate files, or relay system details back to an operator. Because it is designed to stay hidden, it often values persistence, stealth, and selective data theft over obvious disruption.
In cyber security, this matters because surveillance malware can expose sensitive communications and enable follow-on intrusion without triggering the alarms that ransomware or destructive malware usually creates. Attackers often pair it with command and control channels that blend into normal traffic, such as legitimate messaging, cloud, or web services. Defenders look for unusual process activity, unexpected outbound connections, suspicious permissions, and endpoint telemetry that does not match user behavior. Monitoring host behavior is essential, since the network path may appear ordinary even when the endpoint is compromised.