Google is unveiling a new Android security tool that will help spot spyware attacks

Google introduces Intrusion Logging to help analyze spyware intrusions
Logs daily events such as unlocks, installs, server connections, ADB usage and tampering attempts, stored encrypted in the user’s Google cloud account
Part of Advanced Protection Mode, currently enrolled and limited to Pixel devices on Android 16+, with a wider rollout planned

Google has introduced a new Android feature that aims to help security researchers analyze spyware intrusions.

Called Intrusion Logging, the feature is currently available for select models, with a wider range coming soon.

In a blog outlining its numerous new privacy and security tools for Android, Google said Intrusion Logging works by creating and collecting logs once a day and then storing them in encrypted format in users’ Google cloud accounts.

Boost for Android security

The logs show when the phone was unlocked, when various apps were installed/uninstalled, when the device connected to websites and servers, when the phone was connected to the Android Debug Bridge, and when someone tried to delete the logs related to these events.

Google stores the logs in the cloud to ensure that whoever tampers with the device cannot completely remove their tracks. It also said the company itself does not have access to those logs.

Intrusion Logging is part of Android’s Advanced Protection Mode, a new privacy-oriented mode launched in 2025.

It was developed in collaboration with Amnesty International and Reporters Without Borders to harden the devices commonly used by those who may be targets of governments and state-sponsored hackers: journalists, political dissidents, opposition, human rights activists, diplomats and the like.

Right now, it’s available on all Pixel devices running Android 16+, but should be coming to more devices soon.

Intrusion Logging appears to have good intentions, but may also have some limitations. For example, both Advanced Protection Mode and Intrusion Logging are optional features, meaning they are not turned on by default, and many users probably won’t even know it exists.

So it’s currently only available to the latest and greatest Pixel devices linked to a Google account. Finally, the log also keeps track of browser navigation history and connections, which might be a bit overkill for some.