Malicious app
In plain terms
An app that does what it promises — flashlight, scanner, photo editor — and, on top of that, reads your messages or tracks your movements. It works well: that's what makes it hard to suspect.
Definition
A malicious app is a program voluntarily installed on a phone that performs a visible function while collecting data or carrying out actions the user did not ask for.
How it works
Two paths lead to the same result. The first is imitation: an app copies the name, icon and description of a known service, and places itself in the app store's search results next to the original. The developer name is the only field that tells them apart, and nobody reads it. The second is installation outside the store, presented as necessary to get a free version, a missing feature, or an app "not yet available in your country." It bypasses the store's automated checks, which make up most of the protection. Once installed, the app asks for its permissions at a moment when the user wants to use it, and so is willing to accept: the advertised feature exists precisely to justify the request.
Warning signs
- Unknown developer name, or one slightly different from the expected publisher
- App requesting permissions unrelated to its function
- Installation offered outside the official app store
- Free version of an app that is normally paid
- Many reviews, short and published over a very narrow time window
- Battery or mobile data used noticeably faster after installation
How to verify
Read the developer name, not the app name: it's the field that imitation cannot reproduce exactly. Check it against the publisher's official website, then compare the requested permissions to what the app claims to do. An app that needs neither your contacts nor your location shouldn't be asking for them.
What to do
Install from official app stores and refuse installations outside the store, whatever the reason given. Grant permissions when the feature actually needs them rather than at install time, and periodically clean up: a forgotten app keeps running.
If it already happened
Uninstall the app, then remove its permissions if they remain. Change the passwords of accounts used from this phone, starting with email, and revoke active sessions. Check your carrier bill, since some apps subscribe to premium-rate services.
Frequently asked questions
- It came from the official store, isn't that enough?
- Stores do run checks, but they review a very large number of submissions and an app can change behavior after an update. The check reduces the risk, it doesn't remove it: the requested permissions are still worth reading.
- How can I tell the original from its copy?
- By the developer name, the download count and the first publication date. A widely used app has been around for a long time; a recent copy shows a publication date that doesn't match the popularity it claims to have.
Related attacks
Official sources
This article is part of the Phones and connected devices family. Last updated: 2026-09-03.