Pop-ups appearing on your home screen, battery draining at alarming speed, apps you never installed, data usage suddenly through the roof — these are the classic symptoms of Android malware. If you’re wondering how to remove malware from your Android phone, don’t panic: in most cases you can clean it yourself without losing your data, provided you work through the steps in order.

First, some reassurance. True Android malware is less common than the scare stories suggest — most “infections” turn out to be aggressive adware from a dodgy app rather than a sophisticated virus. Either way, the cleanup process is the same, and it works.

How do I remove malware from my Android phone? Step by step

Step 1: Put the phone in Safe Mode

Safe Mode boots Android with only the essential system apps running — third-party apps (including the malware) can’t launch. The method varies slightly by manufacturer, but generally: hold the power button, then long-press “Power off” until “Reboot to safe mode” appears, and tap OK. You’ll see “Safe mode” in the corner of the screen. If the pop-ups and weird behaviour stop in Safe Mode, you’ve confirmed a third-party app is the culprit.

Step 2: Find and remove the suspicious app

While in Safe Mode, go to Settings → Apps and review the list with fresh eyes. Look for: apps you don’t remember installing, apps with blank icons or strange names, “system” apps you don’t recognise (real system apps can’t be uninstalled, so anything uninstallable claiming to be one is fake), and recently installed apps — sort by install date if your phone allows it. Uninstall anything suspicious. Also check Settings → Apps → Special app access → Device admin apps, and deactivate any unknown app with admin privileges — malware sometimes grants itself this to resist uninstallation.

Step 3: Clear your browser and check for hijacks

Malware often changes browser settings. In Chrome: Settings → clear browsing data, check the homepage and search engine haven’t been changed, and review Site settings → Notifications — rogue sites abuse notification permissions to spam you with pop-ups even after the app is gone. Block notifications from any site you don’t recognise.

Step 4: Run a proper malware scan

Install a reputable mobile antivirus — Malwarebytes, Bitdefender, or Norton all have solid free Android scanners — and run a full scan. (Install it after removing the suspicious apps, from the official Play Store, while in normal mode.) Let it quarantine anything it finds. Then uninstall the scanner if you don’t want to keep it — though keeping one installed is no bad thing.

Step 5: Restart normally and verify

Reboot the phone normally and watch for symptoms over the next day or two. Check Settings → Battery to confirm no unknown app is draining power, and keep an eye on data usage. If everything’s clean, you’re done. If symptoms persist, there’s one final option.

Step 6: The factory reset (nuclear option)

If malware survives the above — rare, but it happens with deeply embedded infections — back up your photos, contacts, and important files (see free photo backup methods), then go to Settings → System → Reset → Factory reset. This wipes everything and returns the phone to out-of-box state, which eliminates any malware that isn’t embedded in the system partition ( vanishingly rare on non-rooted phones). After the reset, reinstall apps only from the Play Store, one by one — don’t bulk-restore, or you might restore the malware too.

How did it get there? (So it doesn’t come back)

Android malware almost always arrives the same way: sideloaded apps — apps installed from outside the Google Play Store. That “free” version of a paid app, the APK from a forum link, the game mod from a YouTube description — these are the delivery vehicles. The Play Store isn’t perfect, but its screening catches the vast majority of malicious apps.

Other common routes: phishing links in texts (“your parcel couldn’t be delivered, tap here”) that install malicious configuration profiles or apps; fake system updates via pop-up ads; and malicious ads in otherwise legitimate free apps. The defences are straightforward:

  • Install apps only from the Google Play Store — never from links, and never enable “install unknown apps” permanently.
  • Check app permissions before installing. A torch app doesn’t need your contacts; a wallpaper app doesn’t need SMS access.
  • Read reviews and check install counts — malware apps typically have few reviews and low download numbers.
  • Keep Android and your apps updated — updates patch the vulnerabilities malware exploits.
  • Be deeply suspicious of unexpected texts with links, especially about parcels, bank “security”, or voicemails.

Malware often announces itself through battery symptoms first — if your phone’s power behaviour changed suddenly, our guide to why phone batteries drain overnight helps distinguish malware drain from ordinary battery ageing. And for your computer’s equivalent protection, see the best free antivirus for Windows.

After the cleanup: hardening your phone

Removing the malware is only half the job — the other half is making sure it doesn’t come straight back. Start with a permissions audit: go to Settings → Privacy → Permission manager and review which apps can access your location, camera, microphone, SMS, and files. Revoke anything that doesn’t clearly need it. Next, turn on Google Play Protect (Play Store → profile → Play Protect) and make sure it’s set to scan regularly — it’s free, built in, and catches a surprising amount.

Consider your browser habits too: install a reputable ad blocker, which eliminates malvertising (malicious ads) as an infection route, and turn on Safe Browsing’s enhanced protection in Chrome settings. Finally, set your phone to install security updates automatically — malware disproportionately infects phones running outdated software with known vulnerabilities. These five minutes of hardening, done once, protect you far more than any antivirus subscription ever will.

The takeaway: Safe Mode, uninstall the suspicious app, clear the browser, scan, verify — that sequence clears the overwhelming majority of Android malware without data loss. Keep the factory reset in reserve for stubborn cases, and prevent reinfection by sticking to the Play Store and treating unexpected links with deep suspicion.