Go to Settings > Accessibility . If an app you don't recognize has permission to "read screen" or "control actions," disable it immediately.
Reputable antivirus software can often detect the "stub" (the malicious code) before it fully executes. The Bottom Line spynote x link
Ensure Google Play Protect is enabled. It is designed to scan for known SpyNote signatures. Go to Settings > Accessibility
SpyNote is a notorious RAT that allows an attacker to gain near-total control over an Android device. Version "X" is often cited as a more stable, enhanced iteration of the original leaked source codes. spynote x link