Recognising Unusual Behaviour
Unexpected changes in your iPhone's performance or behaviour can be a strong indicator of unauthorised software. Keep an eye out for these tell-tale signs.
- Your battery drains much faster than usual, even without heavy use.
- Your iPhone feels warm when it shouldn't be, such as when it's idle.
- New, unfamiliar apps appear on your Home Screen that you don't recall installing.
- Your data usage unexpectedly increases, even when you haven't been using the internet more than usual.
- Your device randomly restarts, crashes, or freezes more frequently.
Good to know
These signs can also indicate other issues, like an aging battery or a full storage. However, if multiple symptoms appear suddenly, it's wise to investigate further.
Checking for Unfamiliar Apps
Unauthorised applications might try to hide, but iOS provides ways to see everything installed on your device. This is often the first place to check.
- Swipe left on your Home Screen to access the
App Library. Scroll through it carefully, looking for any unfamiliar apps. - Go to
Settings→General→iPhone Storage. Review the list of apps and their storage usage. Pay attention to any app you don't recognise, especially those using a lot of data or storage without a clear reason. - Look for apps that have unusual names or generic icons, which can be an attempt to blend in.
Tip
If you find an app you don't recognise, avoid opening it. Instead, make a note of its name and do a quick online search to learn more about it.
Investigating Configuration Profiles
Configuration profiles can alter your device's settings and are sometimes used for legitimate purposes, but they can also be exploited. It's crucial to know how to spot an unwanted one.
- Navigate to
Settings→General. Look for an option calledVPN & Device Management. If this option is not present, you likely don't have any profiles installed. - Tap
VPN & Device Management. Here, you will see a list of any installed Configuration Profiles. Examine each one carefully. - Pay close attention to profiles that you don't remember installing, or those that have names that seem suspicious or out of place (e.g., 'Remote Management', 'Device Admin').
- Tap on any suspicious profile to view its details, including what it can access or control on your device.
Important
Do not delete any profiles at this stage if you are unsure of their origin. Some legitimate work or school accounts may install profiles.
Reviewing App Permissions
Even legitimate apps can become problematic if they have excessive permissions. Regularly reviewing what your apps can access can help you spot suspicious activity. This can indicate an app is doing more than it should.
- Go to
Settingsand scroll down to see your list of apps. Tap on individual apps. - Review the permissions granted to each app, such as access to
Location Services,Contacts,Microphone,Camera, andPhotos. - Look for apps that have permissions enabled that don't make sense for their function (e.g., a simple game wanting access to your microphone or contacts).
- Also, review
Settings→Privacy & Security. This section provides an overview of which apps have access to sensitive information and hardware.
Good to know
It's always better to grant permissions on an 'Ask Next Time' or 'While Using the App' basis, rather than 'Always', for greater control over your privacy.
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers