Contents
APK malware signs split into two groups: before install and after install. Before install, watch for a mismatched package name, a mismatched signer, excessive permissions, and a file size that does not match. After install, watch for battery drain, pop-up ads, and messages you did not send.
By Abdul Emam, APK tester at ApkZena. I reviewed 40 APKs in August and September 2026 and kept four repacks as samples. Two showed no symptoms for three days before they started showing full-screen ads. The delay is real, so behavior matters as much as the install-time scan.
You installed something and now the phone feels off, or you are about to install and want the warning signs first. I have been on both sides of that. I once ignored three days of battery drain before I found the ad clicker. I promise a practical checklist, not scare tactics. You will learn pre-install signs, post-install symptoms, malware types, confirmation steps, and cleanup.
Signs Before Installing
Most malicious APKs announce themselves before installation if you know what to look for. Check these seven signs on the file and the listing.
Package Name Mismatch
Compare the package name on the listing to the official app, like com.whatsapp. A swapped letter or an added word means a clone. Clones can be byte-for-byte functional while still harvesting data. The package name is the cheapest check you can run.
Signature Mismatch
Run apksigner verify --print-certs app.apk and compare the fingerprint to the official copy. A mismatch means a repack. My four sample repacks all failed this check before I found their payloads. The signature guide covers the command.
Excessive Permissions
An app that asks for more than its function needs is suspicious. A photo editor with SMS access, a game with accessibility binding, or a calculator with location. One mismatch is enough to stop. The permission checker guide shows how to read the list.
File Size Anomaly
Compare the download size to the official release of the same version. A repack often weighs more because of the added payload. My 14-detection repack was 6 MB heavier than the clean build of the same version. A large gap warrants a scan.
Suspicious Download Source
A link from a chat message, a search ad, or a file-hosting page is riskier than the developer site or a verified mirror. Check where the link actually points before you download. The trusted source guide lists the signals.
Password-Protected Archives
A password on the archive blocks antivirus scanning on purpose. Legitimate mirrors deliver a plain .apk. If the download is a locked ZIP or RAR, treat it as hostile and delete it.
“Disable Antivirus” Instructions
Any install guide that tells you to disable antivirus or ignore a Play Protect warning is a red flag. Real apps do not need your defenses turned off. That instruction exists to get past the one check that would stop the file.
Signs After Installing
A malicious app can run quietly, but it leaves traces. These eight symptoms are the ones I see most in malicious APK cases.
- Battery drain that cuts runtime from a day to hours.
- Data usage spike from background uploads or ad calls.
- Pop-up ads outside the browser, on the home screen or in other apps.
- Unfamiliar apps appearing that you did not install.
- Overlays on banking apps that look like login screens.
- SMS sent without you, including premium-rate messages.
- Device slowness and heat from background work.
- Settings changed without your input, like accessibility or admin access.
Two or three of these together point to a malicious app. One alone can have a benign cause, like a failing battery. Collect evidence before you act.
Types of Android Malware
Knowing the family helps you predict the damage and act faster. These seven cover most mobile malware I review.
Banking Trojans
Banking trojans use overlay screens and accessibility access to capture logins. They hide inside repacks and fake update prompts. If a game asks to bind an accessibility service, that is the profile.
SMS Fraud
SMS malware sends premium texts or intercepts one-time codes. It needs SMS permission, which is why an SMS grant in a non-messaging app is a hard red flag. The cost shows up on your phone bill.
Spyware
Spyware reads contacts, messages, location, and microphone audio, then exfiltrates it. It often runs quietly with broad permissions. The permission guide shows the combinations to watch.
Adware
Adware shows full-screen and out-of-app ads and clicks on ads in the background. It is the mild end of the range and still a real problem for battery and data. My three-day sample was adware.
Ransomware
Android ransomware encrypts files or locks the screen and demands payment. It spreads through repacks. Keep backups off the device, never pay, and restore from a clean copy after removal.
Crypto Miners
Miners use your CPU to earn someone else on your hardware. Symptoms are heat, lag, and rapid battery drain. They often ship inside modded games with inflated size.
Subscription Fraud
This category signs you up for paid services through hidden flows. It charges small amounts that are easy to miss. Check your carrier and app-store billing for charges you did not authorize.
How to Confirm an APK Is Malicious
Suspicion is not proof. Four checks confirm whether a file is malicious and give you evidence to act on.
Run VirusTotal
Upload the APK to VirusTotal and read the ratio. Five or more major-vendor detections is confirmation. Names like Trojan.Android or Banking are specific. My repack sample scored 14 out of 70. The scan guide explains the verdict.
Check Play Protect
Open Play Store, then Play Protect, and run a scan. Play Protect flags known threats and shows a warning. It is the fastest on-device confirmation, and it also removes some known threats automatically.
Check Permissions
Read the permission list against the app’s function. A spyware profile combines background location, microphone, contacts, and SMS in one app that has no reason for them. The mismatch is itself evidence.
Check the Signature
Compare the signer to the official app. A mismatch confirms the file was re-signed by someone else, which is consistent with a repack. Combined with detections, it is a clear verdict.
What to Do If You Installed Malware
Act in this order: disconnect, uninstall, revoke, scan, change passwords, and reset if needed. Speed matters because some malware starts working within minutes.
Disconnect
Turn on airplane mode or turn off Wi-Fi and mobile data. That stops uploads, remote commands, and SMS fraud while you clean up. Reconnect after the device is clean.
Uninstall the App
Revoke device-admin and accessibility access first, then uninstall from Settings, Apps. If it resists, reboot to safe mode and remove it there. The removal guide covers safe mode.
Revoke Permissions
Remove any remaining grants, especially accessibility, device admin, notification access, and install unknown apps. These are the access points malware uses to persist and reinstall.
Run an Antivirus Scan
Run Play Protect and a second antivirus like Malwarebytes or Bitdefender. Re-scan to confirm the device is clean. One engine can miss what another catches.
Change Passwords
Change passwords for Google, banking, and social accounts, and enable two-factor authentication. Do this from another device if possible. Review account activity for logins you do not recognize.
Factory Reset
If symptoms continue, back up your data and factory-reset the phone. A reset clears user-space malware in nearly every case. Back up photos and messages first, because a reset wipes the device.
How to Prevent Future Infections
Prevention is four habits. None takes more than a minute.
Trusted Sources Only
Download from the developer or a signature-verified mirror. Avoid chat links, search ads, and file-hosting pages. The best download sites guide ranks the trusted options.
Scan Before Install
Run Play Protect and a VirusTotal upload on every file. It takes about a minute. That minute stops most commodity malware before it ever runs.
Keep Play Protect Enabled
Leave Play Protect scanning on and enable improved harmful app detection. It runs for free and catches threats that appear after install.
Avoid Mod APKs
Skip premium-bypass and unlimited-currency builds. The signature guarantee is gone, and the repack pipeline delivers malware. Read mod APK risks before you consider one.
Next, scan every APK you already have installed with Play Protect, review their permissions, and remove anything that does not fit. Then run the six-step check on your next download before you install.
Key Takeaways
- Check the package, signer, permissions, and scan before install.
- Battery drain, pop-up ads, and hidden SMS are the top after-install signs.
- Play Protect plus VirusTotal covers most commodity malware.
- A factory reset clears user-space malware in nearly every case.
Frequently Asked Questions
How do I know if an APK has a virus?
Scan it before install with VirusTotal and check the signer against the official app. A package name mismatch, a signature mismatch, or several major-vendor detections mean malware. After install, watch for battery drain, pop-up ads, and unexpected SMS.
What are the symptoms of Android malware?
Common symptoms are fast battery drain, high background data use, pop-up ads outside the browser, unfamiliar apps appearing, overlays on banking apps, messages you did not send, and a phone that runs hot or slow. Several together suggest a malicious app.
Can malware hide in an APK?
Yes. A repack can carry the real app plus a hidden payload, and some malware delays its behavior for days to avoid detection. That is why a clean scan on day one is not a guarantee. Watch behavior and keep Play Protect scanning on.
What does Android malware do?
Android malware steals data, reads SMS and one-time codes, overlays banking apps to capture logins, sends premium texts, shows ad fraud clicks, mines crypto, or encrypts files for ransom. The damage follows whatever permissions you granted it.
How do I remove malware from Android?
Disconnect from the internet, revoke device-admin and accessibility access, uninstall the app in safe mode if needed, scan with Play Protect and a second antivirus, then change passwords and enable 2FA. Factory-reset if it survives. See the full removal guide.
Can a factory reset remove all malware?
A factory reset removes user-installed malware in almost every case, because it wipes the data and app partitions. Rare system-level malware that persists across resets is possible on rooted or compromised devices, and a full firmware reinstall covers that.
Does Android have built-in malware protection?
Yes. Google Play Protect runs through Play services and scans apps at install and afterward. It is free and enabled by default on most devices. It catches known malware well and unknown repacks less well, so it works best alongside your own checks.
Can a modded APK contain malware?
Yes, and mods are a common delivery route. A mod is re-signed by a third party, so the signature guarantee is gone, and the repack pipeline can add a payload. premium-bypass builds are especially risky. Treat every mod as untrusted.
How long can malware stay hidden?
Some droppers stay quiet for days or weeks before activating, and they can wait for a trigger like a specific app launch. That delay is why behavior checks and periodic Play Protect scans matter even when an app looked clean at install.
Can malware survive a factory reset?
User-space malware does not survive a factory reset, because the reset wipes it. Rare preinstalled or system-level threats can persist on rooted devices. If symptoms continue after a reset, reinstall the stock firmware from the manufacturer.