Google unveils new Android security tool aimed at detecting spyware attacks

Google introduces Intrusion Logging to help analyze spyware intrusions
Records daily events such as unlocks, installations, server connections, ADB usage and tampering attempts, stored encrypted in the user’s Google cloud account.
Part of Advanced Protection Mode, currently opt-in and limited to Pixel devices running Android 16+, with wider rollout planned

Google has introduced a new Android feature aimed at helping security researchers analyze spyware intrusions.

Called Intrusion Logging, the feature is currently available on select models, with a wider range coming soon.

In a blog describing its many new privacy and security tools for Android, Google said Intrusion Logging works by creating and collecting logs once a day and then storing them, in encrypted format, in users’ Google cloud account.

Strengthen Android security

The logs show when the phone was unlocked, when different apps were installed/uninstalled, when the device connected to websites and servers, when the phone was connected to Android Debug Bridge, and when someone tried to delete the logs related to these events.

Google stores logs in the cloud to ensure that anyone tampering with the device cannot completely remove their traces. He also said that the company itself did not have access to these logs.

Intrusion logging is part of Android’s Advanced Protection Mode, a new privacy-focused mode launching in 2025.

It was developed in partnership with Amnesty International and Reporters Without Borders, to strengthen the systems usually used by those who could be targets of governments and state-sponsored hackers: journalists, political dissidents, opponents, human rights activists, diplomats, etc.

Right now, it’s available on all Pixel devices running Android 16+, but is expected to come to more devices “soon.”

Intrusion Logging appears to have good intentions but may also have some limitations. For example, Advanced Protection Mode and Intrusion Logging are optional features, meaning they aren’t enabled by default, and many users likely won’t even know they exist.

Then, it’s currently only available on the latest and greatest Pixel devices, linked to a Google account. Finally, the log also keeps track of browsing history and browser logins, which may be a bit too much for some to share.