Eva Galperin: Taking on Spyware and Stalkerware

Most of the security industry spends its days on nation-state hackers and billion-dollar breaches. Eva Galperin spent years on them too, chasing government malware from Syria to Kazakhstan. Then she noticed a threat the industry had quietly decided not to see.

As Director of Cybersecurity at the Electronic Frontier Foundation, Galperin is the person activists, journalists and abuse survivors call when they suspect someone is inside their phone.

And in 2019 she walked onto a stage at a Kaspersky conference with a list of demands for the antivirus industry. To almost everyone's surprise, the industry started saying yes.

Eva Galperin at a Glance

• Galperin was born in Latvia to Jewish parents who fled Soviet antisemitism; the family settled in California in the 1980s, and she was online by the age of 12.
• She studied political science and international relations at San Francisco State University with law school in mind, while working as a Unix system administrator.
• She joined EFF in 2007 on the legal intake team, moved into activism and then international work, and became Director of Cybersecurity in 2017.
• In 2012 she and Morgan Marquis-Boire exposed malware aimed at Syrian activists, and in 2016 she co-authored an EFF report on Operation Manul, a spying campaign against critics of the government of Kazakhstan.
• In 2018 EFF and the mobile security firm Lookout revealed Dark Caracal, a global espionage campaign built on fake versions of Signal and WhatsApp.
• From 2018 she focused on stalkerware, and in April 2019 Kaspersky agreed to flag it as malicious as she prepared to lay out her demands at its conference.
• That November she co-founded the Coalition Against Stalkerware, and her TEDWomen talk on the subject has been played more than 3.6 million times.
• In November 2025 she published a test with AV-Comparatives showing which Android antivirus apps catch stalkerware, and which barely try.

The Life of Eva Galperin

Galperin's Early Years

Eva Galperin was born in Latvia, then part of the Soviet Union, to Jewish parents who left as political refugees. In the 1980s the family settled in California, where her mother worked as a biotechnologist and her father as a computer scientist.

She grew up between San Francisco and Silicon Valley, surrounded by the tech culture of the era, and was online by the time she was 12, years before most of her classmates.

A Sysadmin With Law-School Plans

At San Francisco State University she studied political science and international relations and planned on a legal career. To pay for it she did what a kid raised on Unix could do during the dot-com boom: she worked as a system administrator for a string of companies.

The two halves of that life, the politics and the machines, would eventually fuse. Galperin has said she cares a great deal about asymmetry, the moment when "the surveillance might of the state is focused on people who don't have this protection."

Joining EFF

Galperin joined EFF in 2007, answering the phones and emails on its legal intake team. She moved to the activism team, where she worked on the campaign against the SOPA and PIPA copyright bills, and then to the international team under Jillian York.

Along the way she organized EFF's Tor Relay Challenge and helped write Surveillance Self-Defense, the group's guide to protecting yourself online. In early 2017 she was named Director of Cybersecurity.

Her focus, as EFF puts it, is "providing privacy and security for vulnerable populations around the world."

Hunting Government Malware

In March 2012, as Syria's civil war spread online, Galperin and researcher Morgan Marquis-Boire documented a fake YouTube site that lured opposition supporters into typing their passwords and installing a bogus Flash update that handed attackers control of their computers.

In August 2016 she presented a report at Black Hat USA, co-written with Cooper Quintin, Marquis-Boire and Amnesty International's Claudio Guarnieri, on Operation Manul, a campaign of malware, intimidation and kidnapping aimed at critics of the government of Kazakhstan.

Then, in January 2018, EFF and the mobile security company Lookout revealed Dark Caracal, a global espionage campaign that'd infected thousands of devices with trojanized fakes of Signal and WhatsApp. The real apps were fine, EFF stressed; the victims had been tricked into installing counterfeits.

By then EFF's own description of her work listed malware research in Syria, Vietnam, Lebanon and Kazakhstan, a map of where governments were hacking their own citizens.

The Problem Nobody Wanted

Around 2018 a different kind of victim started showing up in Galperin's inbox. Survivors of domestic abuse described partners who knew everyone they'd called, where they'd been and what they'd said in private, and for whom the usual advice, new passwords and two-factor authentication, did nothing.

The reason, Galperin realized, was that the abuser had compromised the phone itself. A whole industry of consumer "spouseware" or stalkerware made it trivial, and no hacking skill was required. "Full access to someone's phone is essentially full access to someone's mind," she told Wired.

The stakes, she added, were physical. "They get beaten. They can be killed."

What bothered her most was that antivirus companies were able to detect these apps but mostly didn't treat them as threats.

Taking On the Antivirus Industry

In April 2019 Galperin prepared to take the stage at the Kaspersky Security Analyst Summit in Singapore with a talk titled "#Spouseware and #Stalkerware: Where Do We Go from Here?" and a list of demands for the industry: treat stalkerware as the malware it is and warn users when it's found. Kaspersky had already agreed to flag it on Android before she spoke.

"It starts with someone standing up and saying this is not OK, this is not acceptable, this is spying," she said.

The campaign snowballed. In November 2019 EFF became a founding partner of the Coalition Against Stalkerware alongside Kaspersky, Malwarebytes, NortonLifeLock, Avira, G DATA and groups that work with domestic violence survivors and perpetrators. The coalition set out to combine "domestic violence survivor support and perpetrator work, digital rights advocacy, and cybersecurity" against a crime the industry had ignored.

A month later TED posted her TEDWomen talk, which opens with the line that full access to a person's phone is "the next best thing to full access to a person's mind." It's since been played more than 3.6 million times.

Galperin Today

Galperin is still EFF's Director of Cybersecurity, and still measuring the industry she pushed. In November 2025 she published a joint test with AV-Comparatives that ran 17 stalkerware samples past the major Android antivirus apps.

Malwarebytes caught all of them, ESET, Bitdefender, McAfee and Kaspersky each missed one, and Google's own Play Protect caught just 53 percent. Trend Micro managed 59 percent, and the number of distinct stalkerware products on the market had fallen from 20 in the 2020 and 2021 tests to 17.

She's also become the voice reporters reach for, from Washington Post Live in 2019 to NPR in 2022 on consumer tracking devices and Malwarebytes' Lock and Code podcast in 2024 on the arrest of Telegram's CEO.

She also keeps a foot in the bigger picture, speaking in 2025 at a privacy conference in Buenos Aires on what she called cyberfascism, and remaining a go-to voice on everything from Telegram to the Bluetooth trackers that can be turned against their owners.

Eva Galperin: Protecting the People Nobody Else Will

Galperin's career is built on a simple observation: the people most in danger online are rarely the ones with a security team.

She's spent nearly two decades at EFF building the tools, the research and the pressure that protect them, from Syrian activists to the woman whose phone her ex secretly controls.

The antivirus industry ignored stalkerware for years. It took one former sysadmin with a political science degree to make ignoring it embarrassing.