C

Android › Module 3 › Lesson 2

BeginnerModule 3Lesson 2/4

What to Do If Your Phone Is Infected

Containment steps: revoke access, remove apps, reset safely, and recover accounts

15 min+50 XP3 quiz
Module progress2 of 4
!Contain · Investigate · Recover
Alarm · Containment · IR playbook

Opening

Do not keep “just checking” on a dirty phone

If banking freefalls, Accessibility services mutated, or malware hides icons, assume the device may still be watched. Change critical passwords from another clean phone or computer when possible. Order beats panic.

1. Containment Checklist

Suspected Android malware response1. Disconnect Wi-Fi / mobile data if urgently draining money 2. From a CLEAN device: change Google + bank passwords, enable MFA 3. On phone: revoke Accessibility / Device admin / Notification access 4. Uninstall unknown apps (Safe Mode helps if blocked) 5. Run Play Protect scan 6. If still unclean → factory reset after backup of photos only 7. Reinstall apps ONLY from Play; monitor bank alerts

1. Disconnect Wi-Fi / mobile data if urgently draining money
2. From a CLEAN device: change Google + bank passwords, enable MFA
3. On phone: revoke Accessibility / Device admin / Notification access
4. Uninstall unknown apps (Safe Mode helps if blocked)
5. Run Play Protect scan
6. If still unclean → factory reset after backup of photos only
7. Reinstall apps ONLY from Play; monitor bank alerts

2. Account Recovery Focus

Prioritize Google account, email, banking, and authenticator apps. Review account activity for unknown devices. Call your bank using the number on your card if money moved. After reset, do not restore a full app backup that might reinstall malware—prefer photos/media only, then clean app reinstalls.

Safe Mode tip

Booting into Safe Mode disables most third-party apps so you can uninstall stubborn malware. Search your OEM’s Safe Mode steps.

Knowledge Check

1

Where should you change banking passwords if the phone may be infected?

Multiple choice

Knowledge Check

2

True or False: After a factory reset, restoring a full infected app backup can bring malware back.

True or False

Knowledge Check

3

First places to revoke on a suspicious phone?

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)