During an authorized security assessment, "wiretap" on a mobile device can mean several things: stalkerware installed by an abusive partner, enterprise MDM monitoring, a malicious app with excessive permissions, a compromised device via a sophisticated implant, or even a network-level interception. I'll cover detection and removal for each category, with evidence preservation as a priority — if this has legal implications, the forensic trail matters as much as the removal its