Targeted surveillance is malware activity aimed at specific people, organizations, or communities rather than mass infection. The goal is usually intelligence collection: stealing messages, documents, credentials, location data, or device activity from a carefully chosen victim. Because the operation is narrow, it often tries to stay quiet for as long as possible.
This matters in cyber security because the attacker’s success depends on hiding inside a trusted device, not on breaking a large number of systems. In real attacks, targeted surveillance may begin with a phishing message, a malicious attachment, or abuse of a trusted app account, then continue through persistence, data theft, and covert exfiltration. Defenders look for unusual logins, suspicious autostart entries, strange binaries in user folders, and unexpected account-linked devices. Unlike broad malware campaigns, the risk here is often personal and strategic: one compromised endpoint can expose private conversations, networks of contacts, and sensitive plans.