Google launches new Android security feature to help uncover spyware attacks

Google is rolling out "Intrusion Logging" as part of Android's Advanced Protection Mode to help security researchers and at-risk users detect and investigate spyware and forensic-tool intrusions. The feature collects daily encrypted logs (stored in the user's Google account) of events such as device unlocks, app installs/uninstalls, network connections, ADB connections, and attempts to delete logs; Amnesty International collaborated with Google on the design. Limitations include Pixel-only availability, Android 16+, Advanced Protection opt-in, and potential user hesitancy to share navigation history.