Key takeaway
Choose apps from trusted stores, grant only permissions needed for their function and install system updates. After a suspicious message or app, review accounts from a clean device; report a work phone to your organization’s IT team promptly.
What mobile malware can do
Mobile malware is malicious code designed for phones, tablets and wearables. A Trojan may disguise itself as an app and steal passwords or payment details; spyware may collect messages or location; ransomware may restrict access to files or a device. Adware can create unwanted ads and redirects. An app can also collect more information than it needs without being malware, so review what it requests and why.
Common mobile threat patterns
Mobile attacks can combine apps, messages and device accounts. Watch for these patterns.
Fake or repackaged app
An app resembling a popular game, bank or system utility may steal passwords, display ads or install another payload. A familiar name or icon does not prove authenticity.
Banking Trojan and fake sign-in
An app or screen overlay may try to capture banking credentials. Open your bank through its official app or an address you enter yourself, not a message link.
Spyware and permission abuse
Location, contacts, microphone, camera, notifications and accessibility permissions can expose sensitive information about a user and device. Decline requests unrelated to an app’s function and review permissions already granted.
SMS and messaging attacks
A fake delivery, account or payment message may lead to a malicious link or attachment. Mobile banking and SMS one-time codes can be at risk. Never share a code with a caller or message sender, whether you requested it or not; entering it yourself in the verified official sign-in flow is different.
Ransomware and adware
A malicious app may make files unavailable or lock a device. Adware can create recurring pop-ups, redirects and data use. Do not tap a “clean” button in a frightening pop-up.
How apps reach a phone
Apps may arrive through a deceptive listing in an official store, off-store installation where the platform and organizational policy allow it, a link in a message or email, malicious advertising or a compromised web page. Operating-system and app-store checks can reduce risk, but they do not replace reviewing the source, publisher and permissions. If off-store installation is allowed, verify who provided the file; on Android, turn off the installation permission afterward. Available iPhone installation paths depend on region, system version and device management policy.
Review permissions on Android and iPhone
Judge a permission by the app’s function, not its name. A map may need location while in use; a basic calculator asking for ongoing access to contacts, SMS or a microphone deserves scrutiny. Revoke access that is not needed and review the app again.
Android
In Settings, open the apps and permissions controls and review each app’s access to location, camera, microphone, contacts and other data. Keep Google Play Protect app scanning enabled; it can warn about and disable some harmful apps installed from the Play Store or other sources. Menu names vary by manufacturer and Android version.
iPhone
In Settings > Privacy & Security, review access to location, camera, microphone, contacts and other data. App Privacy Report starts recording permission use and network activity after you enable it; it does not diagnose infection. On supported iPhone and iOS versions, Safety Check helps review sharing and account access; it is not a malware scanner. Some settings may be restricted on managed devices.
Reduce mobile risk
Combine careful app selection, account security, software updates and safer connection habits.
Check the app and publisher
In the official store, compare the app name, publisher, update date and reviews. Verify the sender through another channel before opening an installation file sent in a message.
Decline unnecessary permissions
Compare permission requests with the app’s specific function. Review access to location, SMS, contacts, camera, microphone and accessibility periodically.
Update the OS and apps
Install available operating-system, app and browser updates. Do not defer security updates, and check the manufacturer’s support policy for a device that is no longer supported.
Protect accounts
Use a unique password for each account and enable MFA where supported. Do not share one-time codes, passwords or recovery links with a caller or message sender; check account alerts through a trusted official channel.
Network and backups
For sensitive activity on public Wi-Fi, use a network you trust and check for an HTTPS connection; a fake sign-in page or warning can still be fraudulent even when it uses HTTPS. Keep recoverable backups of important photos and documents.
Respond to a suspicious app or account
Handle the incident without losing evidence or following an attacker’s instructions. On a personal phone, assess device compromise and account access separately. On a work phone, IT or security directs the response order, weighing active harm, remote-management access and evidence preservation.
Stop and do not reopen the link
Do not call a number in a fake warning or install its suggested “cleaner.” Do not pay or share verification codes.
Disconnect the suspicious device
If the device appears to be causing active harm, consider limiting its network access. On a managed work phone, follow IT guidance before turning off Wi-Fi or mobile data so remote management and evidence needs are considered.
Review the app and account from a trusted device
Record the app name and where it came from. From a clean device, review account sessions and sign-in history, end suspicious sessions and change the password; update other accounts if the same password was reused.
Get support and a security check
If a work phone or bank account is affected, contact IT or the bank through an official channel. On Android, run a Play Protect check. On iPhone, review suspicious apps, profiles and account access with Apple support or IT; do not follow ads claiming to scan the entire system.
Recover and monitor
If an account was taken over, first secure its password and sessions from a trusted device; that alone does not require resetting the phone. If serious device compromise is confirmed, a specialist can assess evidence and policy before deciding on reset or rebuild. Restore checked data from a backup without reinstalling the suspected app or configuration. Continue monitoring account alerts and payments.
Frequently asked questions
These answers cover app checks, permissions and first actions after a suspicious event.
What is mobile malware?
Software or code designed to harm a phone, tablet or wearable, steal information or gain unauthorized access.
How can I protect Android and iPhone?
Install apps from official stores, review permissions, update the OS and apps, use MFA, and handle unexpected links and verification codes carefully.
How do I check whether an app is safe?
Compare the publisher, store listing, update date, requested permissions and credible reviews. Decline unnecessary access and do not sideload a suspicious file.
What should I do if I installed an unfamiliar app?
Do not open the app or follow its warnings. Report a work phone to IT and follow its guidance for checks. Review accounts from a trusted device and change passwords where needed. On Android, use a Play Protect check; on iPhone, review the app, profiles and account access with Apple support or IT.