Home/Digital threats

Devices

Malicious apps

Fake or booby-trapped apps that steal data or money once installed.

What it is

A malicious app looks useful — a game, a wallpaper pack, a “system cleaner,” or a copy of a popular app — but hides code that steals your data, shows scam ads, signs you up for paid services, or spies on you. Some are outright fakes; others are real apps that were tampered with.

How it happens

These apps spread through unofficial app stores, links in messages, and sideloaded files, and occasionally slip briefly into official stores. Once installed, the app requests broad permissions — contacts, messages, accessibility — that let it do far more than its stated purpose, often continuing to run invisibly in the background.

Warning signs

  • An app requests permissions that have nothing to do with what it claims to do.
  • Fast battery drain, overheating, or unexpected data use after installing something.
  • Pop-up ads appearing outside the app, or new icons you don't recognise.
  • The app came from a link or an unofficial store rather than the official one.

Who it targets

People who install apps from outside official stores — often to get paid apps for free or region-locked titles — face the greatest risk. Children and teens are frequently caught by fake games and free “reward” apps that promise in-game currency or prizes.

How to protect yourself

  • Install apps only from the official App Store or Google Play, and never sideload from links.
  • Check the developer, reviews, and download count before installing anything.
  • Review the permissions each app asks for, and deny anything unnecessary.
  • Keep Play Protect or the built-in iOS protections switched on.
  • Remove apps you no longer use — each one is a door you no longer watch.

If it happens to you

  1. Uninstall the suspicious app; if you can't, restart in safe mode or do a factory reset.
  2. Change the passwords for accounts you used on the device, starting with email and banking.
  3. Review app permissions and remove device-admin rights from anything unfamiliar.
  4. Check for unexpected subscriptions or charges and cancel them with your provider.