Google launches Android Intrusion Logging to track spyware

Google has rolled out a feature to help investigate spyware attacks on Android devices, called Android Intrusion Logging, as part of Android Advanced Protection Mode (AAPM). The tool was released on 12 May 2026 and is designed to let high‑risk users log device and network activities for forensic investigations into suspected malware, with the logs including security events, spyware installation and removal, and DNS/connection events.

All forensic logs, collected daily by default, are encrypted with a user‑generated key before securely archived in the user’s Google account, and can later be accessed and decrypted by the user but not by Google or any unauthorised third parties. The feature is opt‑in for Pixel devices on Android 16 and later versions with Advanced Protection mode enabled, and Google plans to roll Intrusion Logging out beyond Pixel devices in the future.

Amnesty International highlighted the importance of secure sharing and informed consent for log data, noting that Intrusion Logging may include sensitive information such as browser navigation history. Donncha Ó Cearbhaill of Amnesty Tech praised Google for the release, explaining that spyware forensic work had previously relied on incidental logs that were often partial and short‑lived.