If your Android phone is acting oddly, malware may not be the only cause—but it is one of the most important possibilities to rule out.
This guide explains how to check Android phone for malware using practical steps that help you identify suspicious behavior, scan safely, and reduce the chance of reinfection.
What Android malware can look like
Android malware is malicious software that may steal data, show intrusive ads, spy on activity, or enroll your device in fraudulent services.
It often arrives through malicious apps, phishing links, sideloaded APK files, compromised websites, or abused accessibility permissions.
Common warning signs include:
- Battery draining much faster than usual
- Unexplained data usage spikes
- Pop-ups or ads outside normal apps
- Apps you do not remember installing
- Overheating when the phone is idle
- Permissions enabled for apps that do not need them
- Calls, texts, or charges you cannot explain
These symptoms can also come from buggy apps or aging hardware, so the goal is to check the device methodically rather than assume every issue is malware.
How to check Android phone for malware step by step
1. Review recently installed apps
Start with the app list in Settings and sort by recent installation if your device allows it.
Look for apps with vague names, no clear publisher, strange icons, or installs that happened around the time problems began.
Pay special attention to apps that request excessive permissions such as SMS access, accessibility services, device admin rights, notification access, or display-over-other-apps permissions.
Malware frequently uses these privileges to persist, hide prompts, or intercept messages.
2. Check Play Protect
Google Play Protect is the built-in security system on Android devices that scans apps for harmful behavior.
Open the Google Play Store, tap your profile icon, then go to Play Protect and run a scan.
Play Protect can detect many known threats, but it is not perfect.
A clean result does not guarantee the device is free from malware, especially if the malicious app was installed outside the Play Store or is using new tactics.
3. Look at battery and data usage
Unusual battery drain and data consumption can reveal a hidden app running in the background.
In Settings, review battery usage and mobile data usage by app.
Compare suspicious apps against the rest of the device; an app with high background activity but little obvious function deserves scrutiny.
If a calculator, wallpaper app, or flashlight app is using significant data or battery, that is a strong reason to investigate further.
4. Inspect device admin apps and accessibility services
Some Android threats abuse administrative privileges to make removal difficult.
Check Device admin apps or similar settings on your phone and disable any app that should not have this access.
Also review Accessibility settings.
Malware often requests accessibility access to read the screen, tap buttons, or prevent you from uninstalling it.
If an app has accessibility permissions without a clear reason, disable it unless you trust it completely.
5. Boot into Safe Mode
Safe Mode loads Android with only system apps, which helps you determine whether a third-party app is causing the problem.
If your phone behaves normally in Safe Mode, a downloaded app is more likely to be the cause.
To enter Safe Mode, use the power menu method supported by your device model.
Once in Safe Mode, check whether suspicious behavior stops.
If it does, uninstall recently added apps one by one after rebooting normally.
6. Scan with a reputable mobile security app
A trusted Android antivirus or mobile security app can complement Play Protect by checking installed apps, files, and web links.
Choose well-known vendors with a strong reputation, transparent privacy practices, and regular update cycles.
Look for features such as:
- On-demand malware scanning
- Real-time app monitoring
- Phishing protection
- Web reputation checks
- App permission analysis
A security app should come from the Google Play Store or the vendor’s official source.
Avoid “cleanup” utilities with aggressive ads or unverified claims, as these can create more problems than they solve.
Where Android malware often hides
Malware does not always appear as a obvious “virus” app.
It may disguise itself as a system utility, file manager, QR scanner, battery saver, browser add-on, or even a fake update prompt.
It can also hide through:
- Sideloaded APKs from unknown websites
- Fake streaming, banking, or game apps
- Browser notifications and phishing pages
- Malicious SMS links and social engineering
- Compromised third-party app stores
On Android, the most important defense is app-source discipline: install only what you trust, and review permissions before tapping Allow.
What to do if you find a suspicious app
If you identify an app you do not trust, disconnect from Wi-Fi and mobile data if you suspect active data theft, then take a screenshot or note the app name before removing it.
This can help if you later need support from your carrier, bank, or IT team.
Then follow these steps:
- Revoke administrator and accessibility permissions.
- Force stop the app if possible.
- Uninstall it from Settings or the app drawer.
- Restart the phone and run another scan.
- Change passwords for important accounts from a trusted device.
If the app refuses to uninstall, starts itself again, or reappears after removal, a factory reset may be the safest next step.
How to secure your Android phone after a malware check
After you remove suspicious software, reduce the risk of future infections by tightening a few core settings.
Most successful Android compromises rely on user approval, weak app hygiene, or outdated software.
- Install Android and security updates promptly
- Use Google Play Store instead of random APK sources
- Review app permissions regularly
- Turn off installation from unknown sources unless needed
- Use a strong screen lock and device encryption
- Enable two-factor authentication on Google and financial accounts
- Avoid clicking links in unexpected texts or emails
For devices used in a business or family setting, consider managing app installs centrally and restricting sideloading entirely.
When a factory reset makes sense
A factory reset is the most reliable way to remove persistent malware from an Android device, but it also erases local data.
Use it when you see repeated reinfection, suspicious admin-level control, or behavior that continues after uninstalling questionable apps.
Before resetting, back up photos, contacts, and documents carefully.
Do not restore a full device backup if you suspect the backup contains the malicious app or its settings.
After the reset, reinstall apps one at a time from trusted sources and watch for the issue returning.
How to tell malware from normal phone problems?
Not every slow or hot Android phone is infected.
Storage shortages, failing batteries, poor network conditions, and buggy apps can create similar symptoms.
The difference is consistency: malware often causes repeated, unexplained, and background-heavy activity that persists across reboots and Safe Mode checks.
If the phone only misbehaves when a specific app is open, the app may simply be poorly optimized.
If the problem continues when that app is removed, the chance of malware or a deeper system issue increases.
Key indicators to remember
- Check app installations, permissions, and background activity first
- Use Play Protect and a reputable security app together
- Test in Safe Mode to isolate third-party apps
- Remove device admin and accessibility access from unknown apps
- Reset the phone if the threat persists or control is lost
By combining these checks, you can quickly learn how to check Android phone for malware without relying on guesswork or unnecessary factory resets.