Android phone hacked what to do? Here is the practical answer: do not rush into a factory reset, and do not keep using that phone to log in to important accounts. A safer order is to disconnect risky connections, review suspicious apps and permissions, check Play Protect and restricted settings, then change passwords from a trusted device. Google's official help pages on safe mode, permissions, and restricted settings form a useful troubleshooting chain.［1］［2］［3］

The real danger is often not that your phone becomes completely controlled overnight. It is that you suspect something is wrong but still use the phone for verification codes, settings changes, and email logins.

If you are mainly worried someone is spying on your phone, start with Is someone spying on my phone? 8 high-risk signs and a practical check order.

Use the digital privacy guide as the wider checklist: it connects this issue to accounts, devices, identifiers, and data-broker exposure.

Key Takeaways

If you suspect your Android phone was hacked, your first job is damage control, not an immediate reset.［1］［2］［3］

Check recently installed apps, sensitive permissions, accessibility permissions, and unusual background activity first.

Safe mode is useful because it helps you tell whether the issue is triggered by a third-party app.［1］

Change passwords from a trusted device where possible. Do not keep relying on the suspicious phone for core verification codes.

Consider factory reset when anomalies continue, cleanup is incomplete, or high-risk signs are clear.

First check: which signs should you treat as high risk?

If several of these happen together, do not dismiss them as normal lag:

battery use and mobile data spike unexpectedly;
unfamiliar ads appear, or the browser redirects often;
apps appear that you did not install;
SMS, chat, or email actions happen without you;
the permissions screen shows unreasonable sensitive access;
the phone downloads, installs, or redirects by itself.［2］［3］

Follow these 7 steps first

1. Disconnect unnecessary network connections

Turn off mobile data, Wi-Fi, Bluetooth, and hotspot unless you need one connection for troubleshooting. This is not the final fix, but it reduces continued communication and remote-control risk.

2. Boot into safe mode

Safe mode helps you observe whether the problem is mainly caused by a third-party app.［1］ If pop-ups, redirects, and other anomalies drop sharply in safe mode, focus on apps you installed later.

For a deeper walk-through, read What is Android safe mode? When to use it and what to check after booting (2026).

3. Review recently installed apps and remove unknown ones first

Focus on:

recently installed cleaners, boosters, cracked apps, or modded tools;
apps downloaded from SMS links, browser pop-ups, or third-party stores;
suspicious apps named like system updates, device protection, or support assistance.

4. Check sensitive permissions and restricted settings

Google's help pages point to permission management, restricted settings, installing unknown apps, and accessibility access as areas worth checking carefully.［2］［3］ If an unfamiliar app has any of these permissions, revoke them first, then consider uninstalling the app.

5. Run Play Protect or a system security check

Google Play Protect can help detect some harmful apps.［4］ It is not perfect, but it is useful for a first pass.

6. Change passwords from a trusted device

Suggested priority:

Email;
Google account;
Banking and payments;
Social and messaging accounts.

The trusted-device part matters. If the Android phone is no longer trustworthy, changing passwords on it may expose the new passwords too.

7. Decide whether a factory reset is necessary

I would lean toward backing up only necessary data and resetting if any of these are true:

the suspicious behavior cannot be fully removed;
problems return after restart;
sensitive permissions keep coming back;
you entered many sensitive accounts and cannot confirm cleanup is complete.

Before factory reset, do this first

Save the contacts, photos, and important files you actually need;
Do not restore a full system image or suspicious apps blindly;
After backup, restore clean data first, not unknown installers;
After reset, update the system before logging in to core accounts.

What can make things worse?

Continuing to use the phone for verification codes while you suspect compromise;
Installing more "cleaner" apps before checking permissions;
Removing the visible app but not checking sensitive permissions and accessibility access;
Factory resetting and then restoring the same suspicious backup.

If spam texts, suspicious links, and Android phishing are part of the problem, also read How to stop spam texts on Android: 7 methods that actually help (2026).

My advice: put factory reset near the end of the process, not at the beginning

Many people want a one-step fix when they panic. But after safe mode, permission review, suspicious app removal, Play Protect, and account damage control, you can usually tell whether:

the problem is one malicious app;
or the device itself is no longer worth trusting.

That keeps you from resetting too early and from delaying when reset really is the safer move.

Summary

Android phone hacked what to do? Disconnect risky connections, boot into safe mode, review apps and permissions, then change passwords from a trusted device.［1］［2］［3］
Sensitive permissions, restricted settings, and recently installed unknown apps are the key areas to inspect.
Play Protect and system checks are useful first passes, but they do not replace complete damage control.
If anomalies continue, cleanup is incomplete, or sensitive accounts were widely exposed, consider factory reset.

FAQ

What is the first thing to do if my Android phone was hacked?

Reduce risky connections and stop using it to log in to core accounts or receive important verification codes.

Is safe mode really useful?

Yes. It helps you determine whether the issue mainly comes from a third-party app.［1］

Is deleting a suspicious app enough?

Usually not. Also check restricted settings, install sources, accessibility access, and other sensitive permissions.

When should I factory reset?

When suspicious behavior continues, permissions return repeatedly, cleanup cannot be confirmed, or you exposed many sensitive accounts.

Should I change passwords on the same phone?

Prefer not to. Use a trusted device so the new passwords are not exposed too.

Does factory reset always solve it?

It usually reduces risk significantly, but restoring suspicious backups or high-risk installers can bring the problem back.

Disclaimer

This article is for general device security education only and does not constitute technical attribution for a specific sample, device model, or forensic result.

As the publisher, AethoVPN notes that Android phone hacked what to do remains outside what a VPN can fix.

Sources

Google Help, Reboot to safe mode on Android: https://support.google.com/android/answer/7665064
Google Help, Manage app permissions on Android: https://support.google.com/android/answer/9431959
Google Help, Learn about restricted settings: https://support.google.com/android/answer/12623953
Google Help, Help protect your device from harmful apps with Google Play Protect: https://support.google.com/googleplay/answer/2812853

Sources checked 8 May 2026.

Related Articles:

Android phone hacked what to do: 2026 Guide