Google unveils new Android security tool looking to help spot spyware attacks

• Google introduces Intrusion Logging to help analyze spyware intrusions
• Logs daily events like unlocks, installs, server connections, ADB use, and tampering attempts, stored encrypted in user’s Google cloud account
• Part of Advanced Protection Mode, currently opt‑in and limited to Pixel devices on Android 16+, with broader rollout planned

Google has introduced a new Android feature aimed at helping security researchers analyze spyware intrusions.

Called Intrusion Logging, the feature is currently available to select models, with a wider range being available soon.

In a blog outlining its numerous new privacy and security tools for Android, Google said Intrusion Logging works by creating and collecting logs once a day, and then storing them, in encrypted format, in the users’ Google cloud account.

Boost to Android security

The logs show when the phone was unlocked, when different apps were installed/uninstalled, when the device connected to websites and servers, when the phone was connected to Android Debug Bridge, and when someone tried to delete the logs related to these events.

Google is storing the logs in the cloud to make sure whoever tampers with the device cannot completely remove their traces. It also said that the company itself does not have access to these logs.

Intrusion Logging is part of Android’s Advanced Protection Mode, a new privacy-oriented mode launched in 2025.

It was developed in partnership with Amnesty International and Reporters Without Borders, to harden the devices usually used by those who might be targeted by governments and state-sponsored hackers: journalists, political dissidents, opposition, human rights activists, diplomats, and similar.

Right now, it is available on all Pixel devices running Android 16+ but should be coming to more devices “soon”.

Intrusion Logging appears to have good intentions but may also have some limits. For example, both Advanced Protection Mode and Intrusion Logging are opt-in features, meaning they are not turned on by default, and many users probably won’t even know it exists.

Then, it is currently only available to the latest and greatest of Pixel devices, linked with a Google account. Finally, the log also keeps track of browser navigation history and connections, which might be oversharing a bit, for some.

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.