Android Adds Intrusion Logging for Sophisticated Spyware Forensics Ravie Lakshmanan May 13, 2026 Encryption / Spyware Google on Tuesday unveiled a new opt-in Android feature called Intrusion Logging for storing forensic logs to better analyze sophisticated spyware attacks. Intrusion Logging, available as part of Advanced Protection Mode , enables "persistent and privacy-preserving forensics logging to allow for investigation of devices in the event of a suspected compromise," the company said.
The feature, it added, was developed in partnership with Amnesty International and Reporters Without Borders. According to a help document shared by Google, it logs device and network activities on a daily basis, including information about device behavior and the various applications that run on it. The kinds of activities recorded are listed below - App activity (e.g., when an app process starts) App installations, updates, and uninstalls Network connections like starting and stopping Wi-Fi, Bluetooth, DNS lookups, and IP addresses File transfers to or from the device over USB Changes to system certificates When the device is locked or unlocked Google also noted that the log data is end-to-end encrypted by the device and stored on Google servers.
The encryption keys are secured by Google Account password and screen lock credentials, meaning the logs cannot be accessed by any third-party, including Google itself, apart from the device owner. "By storing the data on a secure server, even malware installed on the smartphone cannot access, delete, or manipulate it," Reporters Without Borders said . "End-to-end encryption also ensures that neither Google nor state actors can access the data.
The Intrusion Logging function in particular enables detection and forensic analysis of even highly sophisticated and previously difficult-to-detect attacks." The encrypted logs are stored for a period of 12 months, after which they are automatically wiped. Once Intrusion Logging is enabled, a user cannot delete the logs before the 12-month expiration window, even if the account is closed or the feature is turned off.
Users have the option to download the logs offline, should they prefer to keep them for longer periods. That said, Google has emphasized that once the logs are downloaded and decrypted, users are responsible for their security. "In certain legal or regulatory environments, you may be required by law to provide access to your decrypted data or your security credentials," it pointed out. Another thing to keep in mind when enabling the feature is that it also records network events generated during Chrome Incognito browsing, such as DNS lookups and IP connections, as it operates at the system level and does not distinguish between the browsing modes.
In other words, anybody with access to the decrypted logs can glean what websites were visited, but cannot infer specific pages on those sites. The motivation behind Intrusion Logging is that a high-risk individual, who suspects they may have been targeted by advanced surveillance tools because of who they are and what they do, can share the activity log with trusted security experts for detailed examination.
The logs can be downloaded by navigating to the Settings app, and then tapping Security & privacy -> Advanced Protection -> Intrusion Logging -> Access logs. The feature is currently rolling out to all devices running the Android 16 December update and newer. "With Intrusion Logging, Google is the first major vendor to proactively address the challenge of detecting advanced attacks on devices," Donncha Ó Cearbhaill, head of Security Lab at Amnesty International, said in a statement. "By making more consensual forensic data available for researchers, we can make life more difficult for attackers and help civil society seek accountability when their devices are unlawfully targeted by spyware and mobile data extraction tools." Other Privacy and Security Features Coming to Android Besides Intrusion Logging, Google has announced a raft of privacy and security improvements, including verified financial calls, a new phone call spoofing protection feature to combat attacks where scammers impersonate banks to trick users into revealing sensitive data or transferring funds.
When users receive a call that appears to be from a participating bank, Android asks the installed online banking app to confirm if they are actually attempting to reach the customer. If the app confirms no such is being made, the call is automatically ended by the system. "Your bank or financial institution may also designate numbers as inbound-only, meaning they never use them to call customers," Google said. "Incoming calls from these numbers will be ended directly." The feature is expected to go live on Android 11+ devices with Revolut, Itaú, and Nubank in the coming weeks, before expanding to more banks later this year.
Other notable changes are listed below - Expanding Live Threat Detection to issue warnings about suspicious app behavior, including SMS forwarding and accessibility overlays that are typically used by Android banking trojans to steal credentials. Evaluating downloaded APK files via Chrome on Android for known malware when Safe Browsing is enabled before it's installed. Removing access to the accessibility services API from all apps that are not labeled as accessibility tools.
Disabling device-to-device unlocking and Chrome WebGPU support. Adding scam detection for chat notifications. Enhancing Find Hub's Mark as lost feature with the ability to lock a phone with biometric authentication, blocking thieves from turning off device tracking if a device is marked as lost. Triggering Mark as lost also turns on additional protections like hiding Quick Settings and disabling new Wi-Fi and Bluetooth connections.
Reducing the number of times a third-party with physical access to a device can guess the PIN or password, in addition to implementing longer wait times between failed attempts. Improving device recovery by making a device's IMEI number accessible via the lock screen on devices running Android 12 or higher. Better privacy controls that allow users to share their precise location temporarily for specific tasks while a specific app is open, and provide access to specific contacts to a third-party app, as opposed to sharing the entire address book.
Introducing AISeal with pKVM for hardware-backed, on-device isolation of artificial intelligence (AI)-related data processing. Binary Transparency in Android to ensure integrity through verification of official builds and a public ledger for authentic Google apps and foundational GMS APIs. Hiding SMS one-time passwords (OTPs) from most apps for three hours to block OTP theft by malicious apps that have been granted the SMS permission.
Giving carriers the ability to disable 2G by default to shield customers from legacy technology vulnerabilities . Hardening data protection by introducing post-quantum cryptography to safeguard against future threats. Incorporating explicit user controls to opt-in and out of entire features, security guardrails, and transparency when using Gemini on Android. "By improving protections against banking scams, and extending powerful protections like Live Threat Detection and Android Advanced Protection, we are ensuring that Android remains the most secure platform," Eugene Liderman, director of Android security and privacy, said.
Found this article interesting? Follow us on Google News , Twitter LinkedIn to read more exclusive content we post. Tweet Share Share Share Advanced Protection , Android , Banking Fraud , cybersecurity , encryption , Forensics , Google , Malware , Privacy , Spyware ⚡ Top Stories This Week 30,000 Facebook Accounts Hacked via Google AppSheet Phishing Campaign Trellix Confirms Source Code Breach With Unauthorized Repository Access ⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE and More Progress Patches Critical MOVEit Automation Bug Enabling Authentication Bypass Microsoft Details Phishing Campaign Targeting 35,000 Users Across 26 Countries Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution The Hacker News Launches 'Cybersecurity Stars Awards 2026' — Submissions Now Open ThreatsDay Bulletin: Edge Plaintext Passwords, ICS 0-Days, Patch-or-Die Alerts and 25+ New Stories PAN-OS RCE Exploit Under Active Use Enabling Root Access and Espionage Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions New Linux PamDOORa Backdoor Uses PAM Modules to Steal SSH Credentials Quasar Linux RAT Steals Developer Credentials for Software Supply Chain Compromise 2026: The Year of AI-Assisted Attacks Day Zero Readiness: The Operational Gaps That Break Incident Response We Scanned 1 Million Exposed AI Services.
Here's How Bad the Security Actually Is ⭐ Featured Resources [Webinar] Learn How Autonomous Validation Keeps Pace With AI Attacks [Guide] Get Practical AI SOC Insights to Improve Threat Detection [Demo] Discover How to Control Autonomous Identity Risks Effectively [Demo] Stop Email Attacks and Protect Cloud Workspace Data Faster Cybersecurity Webinars Building Stronger Defenses Stop Patient Zero Attacks Before They Bypass Detection Learn how to stop patient zero attacks before they bypass detection and compromise your systems at entry points.
Register Reduce AppSec Risk Validate Real Attack Paths Before Attackers Exploit Them Learn how to validate real attack paths and reduce exploitable risk with continuous agentic security validation. ⚡ Latest News Cybersecurity Resources Build Security Strategy That Earns Executive Buy-In — SANS LDR514, NYC SANS LDR514 in NYC, Aug 10–15: policy, risk frameworks, board communication, and strategic leadership.
Your VPN is Helping Attackers Move as Fast as AI AI collapsed human response window and turned remote access into fastest path to breach. Earn a Master's in Cybersecurity Risk Management Lead the future of cybersecurity risk management with an online Master’s from Georgetown. Expert Insights Articles Videos From Phishing to Recovery: Breaking the Ransomware Attack Chain May 04, 2026 Read ➝ Mythos is Coming: What the Next Six Months Require Your Biggest Security Risk Isn’t Malware — It's What You Already Trust CTM360 Exposes Global GovTrap Campaign With 11,000+ Fake Government Portals Targeting Citizens Worldwide April 27, 2026 Get the Latest News in Your Inbox Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free.