Signs Your Phone Has Malware, and the False Alarms
Short answer
The signals worth acting on are an app you did not install, pop-ups appearing outside the browser, and data use you cannot account for. Battery drain, heat and slowness are almost always an ordinary app. On iPhone, genuine malware is rare enough that you should check Settings → Notifications and your profiles first.
On this page
Phones are the hardest devices to infect and the easiest to panic about. Both iOS and Android sandbox applications so that one app cannot read another’s data or modify the system, and both distribute software through a reviewed store. The result is that the symptoms people associate with infection are, on a phone, nearly always something else.
That does not make phone malware imaginary. It makes it specific, mostly Android-side, and mostly arriving through one route. Knowing the difference saves you from factory resetting a phone whose real problem was a notification setting.
The false alarms, which are most of them
Check these before anything else. In order of how often they are the actual answer.
Battery drains quickly and the phone is hot. This is an app running in the background, a weak signal keeping the radio at full power, or a battery past its useful life. Both platforms tell you which app:
- Android: Settings → Battery → Battery usage
- iPhone: Settings → Battery, scroll to the usage list
Working out which app is draining your battery goes through reading those screens properly. Malware deliberately avoids this profile, because being noticeably expensive is how it gets uninstalled.
Pop-ups and alerts. Overwhelmingly these are website notifications you allowed at some point, often by tapping Allow to dismiss a prompt. They appear in the notification shade looking exactly like app notifications, which is why people assume an app is responsible.
Check Settings → Notifications and revoke anything from a website or an app you do not use. In Chrome, Settings → Notifications lists sites individually — stopping websites sending notifications in Chrome covers that cleanup. On iPhone, also check Calendar for subscribed spam calendars, which generate alerts that look like system warnings.
The phone is slow. Storage pressure first. A phone with almost no free space slows down measurably, and what is taking up your iPhone storage or why Android says storage is full usually explains it. Age and newer, heavier app versions account for most of the rest.
A virus warning in the browser. Not real. No operating system reports an infection through a web page. These are adverts, and the whole mechanism is explained in how the fake virus warning scam works.
Mobile data usage is high. Check which app, in Settings. Video, photo backup and automatic updates account for nearly all of it.
What counts as actual evidence
| Signal | Why it matters | Platform |
|---|---|---|
| An app you did not install | Little innocent explanation | Android mostly |
| Pop-ups over other apps | Requires overlay permission | Android |
| Device admin app you do not recognise | Hard to remove by design | Android |
| An unknown configuration profile | Can control settings and traffic | iPhone |
| Data use from an app that should not use data | A calculator sending data is wrong | Both |
| Texts or calls you did not send | Premium-rate abuse | Android mostly |
The first row is the strongest. Scroll your full app list — Settings → Apps → See all apps on Android, or the App Library on iPhone — and look for anything you cannot account for. Be aware that carrier and manufacturer apps are preinstalled in quantity and look unfamiliar without being malicious.
On iPhone, the one thing genuinely worth checking is Settings → General → VPN & Device Management. A configuration profile on a personal phone, with no school or employer behind it, should not be there and should be removed. Profiles can install certificates and route traffic, which is the closest thing to a real non-jailbroken iOS compromise most people will encounter.
On Android, check Settings → Security & privacy → More security settings → Device admin apps, and Settings → Apps → Special app access → Display over other apps. Malware uses both, and both are unusual for ordinary applications to need.
How Android phones actually get infected
One route dominates: installing an app from outside the Play Store.
That means APK files from websites, third-party app stores, “modded” versions of paid apps, and links sent by message. It also includes apps installed during a phone call with someone offering support, which is a growing category and worth treating as an absolute red line. No legitimate support process requires you to install an app from a link during a call.
Play Protect scans apps on install and periodically afterwards, and it is on by default. Confirm under Play Store → your profile icon → Play Protect. It is not perfect, and some bad apps reach the Play Store, but the gap between store-only and sideloading is very large.
iPhones that have not been jailbroken are in a different position entirely. Sophisticated iOS attacks exist and are used against specific individuals; they are not what reaches ordinary people, and they are not what an antivirus app could detect in any case.
Cleaning up, in order
1. Uninstall what you found. Settings → Apps, select, Uninstall. If the Uninstall button is greyed out, the app has device admin rights — revoke those first in the device admin screen, then uninstall.
2. Revoke the permissions. Overlay, accessibility and device admin permissions are the three that matter. Accessibility in particular grants an app the ability to read screen content and act on your behalf, so anything holding it that is not a genuine accessibility tool should lose it.
3. Remove profiles on iPhone, as above.
4. Clear browser notifications and check the homepage.
5. Run Play Protect’s scan on Android, from the Play Protect screen.
6. Change passwords from a different device if the app had accessibility permission or you entered credentials while it was installed. The phone is not the place to do this until it is clean.
7. Factory reset only if symptoms persist. Settings → System → Reset options → Erase all data on Android, or Settings → General → Transfer or Reset iPhone. Back up photos and documents first; a reset erases everything. Then set the phone up fresh and reinstall apps deliberately — restoring a full backup can reinstate the app you were removing.
About phone antivirus apps
On iPhone, they cannot scan other apps, because iOS does not permit it. What they sell is a VPN, a web filter and a reassuring interface. If you want those, buy them for what they are.
On Android, Play Protect covers the common cases. A reputable third-party scanner adds something if you sideload, and nothing much if you do not. The security app category on both stores contains a significant quantity of low-value software with aggressive subscription billing, so the one you install matters more than whether you install one.
Realistic expectations
Most phones checked this way are clean, and the symptom is a notification setting, a background app or a full storage volume. That is the usual and unglamorous outcome.
Where something is found, it is an Android app from outside the Play Store, removable in a few minutes, with permission cleanup afterwards. The honest limit is that an Android phone no longer receiving security updates — common on cheaper handsets after two or three years — cannot be fully secured by anything you install, and that is a hardware replacement question rather than a malware one.