Answer first: identify and isolate before erasing
Record the app name, developer, source, permissions, and suspicious symptoms first. Do not label an app as malware based only on battery drain, heat, or microphone/camera activity; legitimate apps and system processes can produce similar signals.
Android: Play Protect, permissions, then uninstall
- Check Google Play Protect and its scan status.
- Open Settings → Apps → the relevant app and review permissions and app information.
- Use Permission manager or Privacy Dashboard to compare camera, microphone, location, SMS, and other access.
- Uninstall the app through Android settings or Google Play when appropriate.
- Apply Android and Google Play system security updates.
Google states that Play Protect can warn about, disable, or remove potentially harmful apps. Google also recommends removing apps you do not trust and reviewing account security if malware is suspected.
If an Android app will not uninstall
An app that cannot be uninstalled is not automatically malicious. System apps, preinstalled apps, and managed apps can have legitimate restrictions.
If the phone is crashing, freezing, slowing down, or behaving abnormally, Google recommends using Safe mode to check whether a downloaded app is responsible. Safe-mode entry differs by manufacturer. If the issue disappears in Safe mode, remove recently downloaded apps one at a time and retest after each restart.
iPhone/iPad: check the app list and configuration profiles
Apple recommends reviewing the installed app list if you are concerned an app was installed without permission. If you do not recognize an app, check its purpose in the App Store before removing it.
Also inspect Settings → General → VPN & Device Management. Unknown configuration profiles or management settings can install VPN, certificate, account, or other configuration data. On school- or company-owned devices, contact the administrator before removing a profile.
Suspicious login or charges require a separate account-security response
Removing an app does not automatically end an account compromise. From another trusted device, review sign-in history, change exposed passwords, confirm multi-factor authentication, and contact the relevant financial or service provider when needed.
Factory reset is a last step, not the first
Google notes that a device reset or manufacturer support may be required if malware symptoms remain. Before a reset, preserve needed evidence and confirm backups, authentication apps, account credentials, and SIM/eSIM recovery paths.
Browser pop-ups, fake warnings, and redirects
Check whether the issue is browser notifications or site data rather than an installed app.
Reset safety diagnosis
Prepare backups, authentication, and SIM/eSIM before erasing the device.