How to check if your phone has malware

That doesn’t prove malware. Phones also get weird when storage is full, apps misbehave, or an update goes wrong. But those symptoms are worth checking.

Start with the boring explanations first. Then look for malware.

Signs worth taking seriously

One symptom by itself is rarely enough. A cluster of symptoms is more useful.

Battery drain is a good place to start. Go to Settings > Battery > Battery usage and look for apps using more power than makes sense. A navigation app using battery after a long drive is normal. A QR scanner burning through battery overnight is not.

Check mobile data too. Go to Settings > Network & internet > Data usage, or Settings > Connections > Data usage on Samsung. Malware that uploads data, pulls ads, or talks to a command server has to use bandwidth somewhere.

Pop-up ads outside the app that created them are a bigger warning sign. Ads inside a free game are annoying. Ads floating over the home screen, lock screen, or Settings app usually mean adware.

Unknown apps are another clear signal. Open Settings > Apps and scan the full list. Look for generic names, blank icons, duplicate-looking utilities, apps with names like “System Service” that clearly didn’t come from the phone maker, or anything installed around the time the problem started.

Heat and slowdown can matter, but don’t overread them. A phone can overheat because of poor signal, a stuck app, charging in the sun, or a failing battery. Malware is one possible cause, not the default answer.

Run a Google Play Protect scan

Every Google-certified Android phone has Google Play Protect. Open Google Play Store > profile icon > Play Protect, then tap Scan.

Make sure Scan apps with Play Protect is on. Also turn on Improve harmful app detection if you install apps from outside the Play Store, because that lets Google analyze unknown apps more deeply.

Play Protect checks apps when you install them and periodically scans the device afterward. Google says Play Protect scans 200 billion Android apps daily, and it can warn you, disable an app, or remove a harmful app automatically.

This is the first scan to run. It isn’t perfect, but it’s built in and it covers sideloaded apps too.

Review suspicious permissions

Open Settings > Security & privacy > Permission manager. On some phones, it is under Settings > Apps > Permission manager.

Look at camera, microphone, location, contacts, SMS, phone, and files or media. The question is simple: does this app need that permission to do its job?

A messaging app with microphone access makes sense. A calculator with SMS access doesn’t. A wallpaper app with accessibility access is a red flag unless it has a very specific feature you understand.

Revoke anything that looks wrong. If an app breaks because you removed a permission it never should have needed, uninstall it.

Check recent installs and sideloaded apps

Most Android malware starts with an app install. That can be a malicious app from a website, a fake update prompt, a modified APK, or a bad app that slipped through a store review.

Open Google Play Store > profile icon > Manage apps & device > Manage, then sort by recently updated or installed. Compare that list with when the symptoms began.

For sideloaded apps, inspect them more carefully. On many recent Android phones, the app info screen shows where an app came from. If the source is a browser, file manager, messaging app, or unknown package installer, treat it as higher risk.

Don’t keep APK files around just because they were hard to find. That is how people talk themselves into keeping sketchy software.

Use Safe Mode

Safe Mode starts Android with third-party apps disabled. If pop-ups, overheating, or strange background behavior stop in Safe Mode, a downloaded app is probably responsible.

On many phones, hold the power button, then long-press Power off on the screen and choose Safe Mode. On Samsung, the same method usually works. Some brands use a slightly different button sequence, so search your model if the option doesn’t appear.

Stay in Safe Mode long enough to test the symptom. Then restart normally and uninstall recent or suspicious apps one at a time.

Start with sideloaded apps, then utilities that request accessibility, notification access, device admin, SMS, or overlay permissions.

If an app won’t uninstall

Some malicious apps make themselves harder to remove by asking for device administrator access or accessibility access.

Check Settings > Security > Device admin apps, or search Settings for “device admin.” Turn off admin access for anything suspicious, then uninstall it.

Also check Settings > Accessibility and remove access from apps that shouldn’t be there. Accessibility access is powerful because it can read screen content and interact with the interface. Password managers and accessibility tools have a reason to use it. A cleaner app does not.

After removal, run Play Protect again.

Change passwords after a real infection

If you found a clearly malicious app, don’t stop at uninstalling it.

Change passwords for accounts used on the phone, especially email, banking, social media, cloud storage, and password manager accounts. Do this from a clean device if possible.

If the app had SMS access, assume one-time codes may have been exposed. If it had accessibility access, assume it could have watched more than its permission list suggests.

Factory reset when you can’t trust the result

A factory reset removes almost all Android malware because it wipes user-installed apps and data. Back up photos, messages, and files first, but don’t restore the exact same app set afterward.

After the reset, reinstall apps manually through Google Play. Avoid restoring unknown APK files or old app backups.

Rare malware can survive by abusing system-level access or preinstalled vendor components, but that is not the normal consumer case. If problems survive a reset on an old unsupported phone, replacing the device is the more realistic fix.

How to lower the odds next time

Keep Android security patches current. Use Google Play or another trusted source for apps. Leave Play Protect on. Be suspicious of APK links sent through messages, fake browser warnings, and “update this app now” pop-ups that don’t come from the Play Store or the phone’s own updater.

And if a website says your phone is infected and asks you to tap a button, close the tab. That’s a scam, not a diagnosis.