It can also come in the form of an app install package. First, it infiltrates your device via a malicious website or even a file attachment. According to Kaspersky, the way spyware works is. Spyware is said to be malicious when it is installed into your device without your consent.