iOS · Recovery Guide

How to Tell If Your iPhone Has Malware or a Suspicious App

Spot the tell-tale signs of unwanted software on your iPhone and learn how to investigate further without making any changes.

Unusual Behaviour and Performance Issues

Malware can often cause your iPhone to act strangely or slow down. Keep an eye out for these common indicators.

Your battery drains much faster than usual, even without heavy use. Check Settings → Battery to see app-specific usage.
Your iPhone feels unusually hot, even when not charging or running demanding apps. This can be a sign of background activity.
Apps crash frequently, freeze, or take a long time to open. Note which apps are causing issues.
You notice unexpected pop-ups, ads, or strange messages appearing on your screen, even when not browsing the web.
Your data usage is higher than normal. Examine Settings → Mobile Data to identify hungry apps.
Your phone restarts itself randomly, or you find it struggling to switch off when prompted.

These symptoms are not definite proof of malware, but they warrant further investigation to rule out other issues like old batteries or app bugs.

Sometimes, unwanted software disguises itself as legitimate apps or consumes resources without your knowledge. Here's what to look for.

You find apps on your home screen or in your App Library that you don't remember downloading. Swipe left through your home screens and check the App Library.
Apps are requesting unusual permissions, such as access to your microphone, camera, or location, that they shouldn't need. Review these in Settings → Privacy & Security.
Your Mobile Data statistics (Settings → Mobile Data) show unexplained high usage from apps you rarely use or don't recognise.
You receive unusual charges on your phone bill, which could indicate premium SMS services or unauthorised in-app purchases.

Be cautious of apps downloaded from anywhere other than the official App Store, as these carry a higher risk of being malicious.

Malware can try to communicate with external servers or interfere with your network connections. Look out for these signs.

Your web browser redirects you to unfamiliar websites, or your search engine changes without your input. Check Safari settings in Settings → Safari.
Messages or emails have been sent from your phone without your knowledge. Check your Messages app and email 'Sent' folders.
Friends or contacts report receiving strange messages or spam from your number or email address.
You notice unusual or persistent network activity indicators (e.g., the spinning wheel next to your Wi-Fi signal) even when your phone is idle.
Your Wi-Fi or mobile data connection frequently drops or experiences unusually slow speeds.

If you suspect your accounts have been compromised, change your passwords immediately, starting with your Apple ID and email.

Sophisticated malware might attempt to alter your iPhone's security settings to maintain persistence or access more data. Verify these areas.

Your Apple ID password has been changed without your permission. Check your account status at appleid.apple.com.
Unfamiliar profiles have been installed on your device. Look under Settings → General → VPN & Device Management.
Location Services are enabled for apps that shouldn't need them, or your location icon appears frequently. Review in Settings → Privacy & Security → Location Services.
You find Restrictions (also known as Content & Privacy Restrictions) enabled or altered under Settings → Screen Time that you didn't set.
Your Safety Check (Settings → Privacy & Security → Safety Check) shows unfamiliar people or apps with access to your information.

Do not delete any unfamiliar profiles or change any settings at this stage; simply note them down for later action if necessary.