Key takeaways
- Unknown apps installed that you never downloaded, especially ones with generic names like “System Update” or “WiFi Service.”
- Battery drain and heat far outside your normal pattern — spyware that streams location and microphone data keeps the CPU awake.
- Data usage spikes that don’t match your browsing. Check Settings → Network → Data usage for apps you don’t recognize.
- Pop-ups outside the browser, ads appearing on your home screen, or your default browser/search engine changing itself.
- Accessibility services you didn’t enable. This is the single biggest red flag: accessibility permissions allow an app to read screens, tap buttons, and capture keystrokes.
- Unexplained login alerts on your Google, banking, or social accounts.
How to Fix a Hacked Android Phone
To fix a hacked Android phone, immediately disconnect it from Wi-Fi and mobile data, change your Google account password from a different trusted device, run a reputable mobile security scan, and audit app permissions before restoring anything. If spyware or a persistent remote-access tool is found, back up only your personal files (not apps or settings) and perform a factory reset as the final step. The entire process usually takes 45–90 minutes and costs nothing beyond your time — unless the phone’s OS itself has been tampered with, in which case a full reflash via the manufacturer’s official tool is the only reliable fix.
Signs Your Android Phone May Be Compromised
Not every glitch is a hack. Android phones commonly show odd behavior from a failing battery, a bloated cache, or a misbehaving app. The indicators below are the ones that genuinely correlate with compromise, according to mobile security advisories from Google’s Android security documentation and third-party threat labs:
Our top picks
As an Amazon Associate we earn from qualifying purchases at no extra cost to you.
- Unknown apps installed that you never downloaded, especially ones with generic names like “System Update” or “WiFi Service.”
- Battery drain and heat far outside your normal pattern — spyware that streams location and microphone data keeps the CPU awake.
- Data usage spikes that don’t match your browsing. Check Settings → Network → Data usage for apps you don’t recognize.
- Pop-ups outside the browser, ads appearing on your home screen, or your default browser/search engine changing itself.
- Accessibility services you didn’t enable. This is the single biggest red flag: accessibility permissions allow an app to read screens, tap buttons, and capture keystrokes.
- Unexplained login alerts on your Google, banking, or social accounts.
The Recovery Checklist, Step by Step
Step 1: Cut off network access (reason: stops live data exfiltration)
Enable Airplane Mode, then turn off Wi-Fi separately (Airplane Mode on some skins leaves Wi-Fi on). A remote attacker or a spyware app that phones home can’t upload your photos, messages, or keystrokes while the device is offline. Do this before you start changing passwords — if you reset your password while the phone is still connected and infected, the malware may simply capture the new one.
Step 2: Change critical passwords from a different, clean device
Use a laptop or another phone you trust. Work in this order, because each account can be used to reset the next:
- Your primary email (the recovery address for everything else)
- Google account — then review Security → Your devices and sign out anything unfamiliar
- Banking, payment, and crypto apps
- Social and messaging accounts (WhatsApp, Instagram, Signal)
Enable two-factor authentication everywhere it’s offered, and prefer an authenticator app or hardware key over SMS codes — SMS can be intercepted via SIM-swap attacks.
Step 3: Enable Google Play Protect and run a scan (reason: catches known malware families)
Open the Play Store → profile icon → Play Protect → Scan. Play Protect is Google’s built-in malware scanner and it runs automatically, but a manual scan forces a fresh check against current definitions. For a second opinion, install a reputable mobile security app from a major vendor (Bitdefender, Norton, Malwarebytes, and ESET all publish Android security products — check the current app listing for the version that supports your Android release). A single scan is not proof of cleanliness, so treat the result as one data point among the checks below.
Step 4: Audit installed apps and permissions (reason: removes the actual attack vector)
Go to Settings → Apps → See all apps and sort by install date. Uninstall anything you don’t recognize. Then visit Settings → Privacy → Permission manager and review these specifically:
| Permission | What a malicious app can do with it | Who legitimately needs it |
|---|---|---|
| Accessibility | Read every screen, tap buttons, log keystrokes, transfer money | Screen readers, password managers, some automation tools |
| Device admin | Prevent uninstall, lock the phone, wipe data | Corporate MDM profiles, legitimate anti-theft apps |
| Install unknown apps | Silently sideload additional malware | Almost nobody — revoke it everywhere unless actively sideloading |
| SMS | Read and send texts, intercept 2FA codes | Your default messaging app only |
| Location (always-on) | Continuous physical tracking | Maps, navigation, fitness tracking — switch to “while in use” |
| Microphone / Camera | Ambient recording, photo capture | Call, camera, and voice apps |
If you find an app with Accessibility or Device Admin access that you can’t identify, remove its admin rights first (Settings → Security → Device admin apps) and then uninstall it. Some malware blocks uninstall until admin rights are revoked.
Step 5: Check for a rooted or tampered system (reason: determines whether a reset is enough)
Install a root-checker utility from a major security vendor; it will flag whether the OS has been modified. If your bootloader is unlocked or the system partition has been altered, a factory reset will not remove the compromise — the malicious code lives below the data layer. In that case you need to reflash the stock firmware using the manufacturer’s official desktop tool (Samsung’s Odin/Smart Switch, Google’s Android Flash Tool for Pixel, or the equivalent for your brand), downloaded from the manufacturer’s own support site. Never use a third-party “unlock” or “root tool” you found in a forum — those are a common malware delivery method themselves.
Step 6: Back up correctly, then factory-reset if warranted
Back up your personal files — photos, videos, documents, contacts — to Google Drive or a computer via USB. Do not restore a full device backup that includes apps and system settings, because that can reinstall the malware. Then run Settings → System → Reset → Erase all data (factory reset).
| Scenario | Recommended action | Typical time | Data loss risk |
|---|---|---|---|
| Suspicious pop-ups, one bad app, accounts clean | Uninstall app, revoke permissions, scan, monitor 72 hours | 20–30 min | None |
| Unknown app with Accessibility access, account alerts | Offline, password reset, targeted backup, factory reset | 60–90 min | Apps and settings lost; photos kept |
| Rooted/tampered OS, device admin malware, banking fraud | Full stock firmware reflash, then fresh setup (no restore) | 2–4 hours | High — treat all local data as exposed |
| Stalkerware installed by someone with physical access | Factory reset, new device passcode, review physical security | 60–90 min | Apps and settings lost |
After the Reset: Closing the Holes
Once you’re back online, harden the device before you reinstall anything:
- Install Android security updates. Settings → System → System update. Unpatched devices are the easiest targets because exploit code is public.
- Turn off “Install unknown apps” for every app that has it enabled.
- Reinstall only from the Play Store, and check that the developer name matches the brand you expect.
- Use unique passwords in a password manager rather than reusing ones you had before.
- Set a strong screen lock — a 6-digit PIN or longer. Biometrics alone don’t protect against someone forcing a change while you’re asleep.
- Review Google account activity weekly for the first month, looking for new sign-ins or connected apps.
Common Mistakes That Prolong the Problem
The most frequent error is resetting the phone but restoring the same full backup, which reinstalls the malicious app on the first boot. The second is changing passwords while the phone is still online — the malware can capture the new credentials and the attacker keeps access. Third, people uninstall the visible app but leave its Device Admin or Accessibility privileges in place, and it reinstalls itself. Finally, using unofficial firmware tools to “clean” the phone often introduces more malware than it removes. If banking credentials were exposed, contact your bank directly rather than relying on the phone alone — your bank’s fraud team can freeze and reissue faster than you can verify the device is clean.
Frequently Asked Questions
Can a hacker remotely access my Android phone without me installing anything?
It’s rare but possible, and it almost always requires an out-of-date Android version with a known, unpatched vulnerability, or a malicious link that exploits the browser. Keeping system updates current closes the vast majority of these holes. If your phone is fully patched and you avoid sideloaded apps, remote access without your interaction is unlikely.
Does factory reset remove all malware from an Android phone?
A standard factory reset wipes user data and installed apps, which removes the overwhelming majority of malware. It does not fix a rooted or modified system partition — malicious code there survives the reset. If a root checker flags your device as tampered, you need a full stock firmware reflash instead.
How do I know if a spyware app is on my phone?
Look for an app with Accessibility or Device Admin privileges that you didn’t enable, unusual battery and data usage, and a device that’s warm while idle. Stalkerware often hides its icon, so checking the permissions list is more reliable than scanning your app drawer. Google Play Protect can flag known stalkerware families, but newer or custom tools sometimes slip past it.
Should I change my passwords before or after removing malware?
After disconnecting from the network, but you can do it from a different trusted device before cleaning the phone. The key rule is never to enter new credentials on the infected phone while it’s still online. Once the phone is cleaned and verified, change them again if you’re unsure.
Is my personal data already stolen if my phone was hacked?
Possibly, and you should assume the worst for any data the malware had access to — messages, photos, and anything visible on screen if Accessibility was granted. Prioritize changing passwords, enabling two-factor authentication, and alerting your bank if financial apps were installed. There’s no tool that can retrieve or “un-send” data that has already left the device.
When should I just replace the phone instead of fixing it?
Consider replacement if the device no longer receives security updates from the manufacturer, if a firmware reflash fails repeatedly, or if the compromise involved banking fraud and you can’t verify the hardware is trustworthy. A phone that stopped getting patches two or more years ago will be reinfected through the same unpatched flaw, so repairing it is often a temporary fix rather than a solution.
