Respond to a Suspicious App

Use a calm containment and evidence workflow when an app behaves unexpectedly.

Core ideas

Use these points to build an accurate technical model before changing the device.

• Disconnect only when continued network access creates clear risk; avoid destroying evidence impulsively.
• Record package name, version, source, permissions, special access and observed symptoms.
• Revoke high-risk access, scan with trusted tools, update the system and change exposed credentials from a trusted device.

Decision rule

A factory reset is a recovery option, not the first diagnostic step; preserve what you need to understand and report the incident.

Apply it on your phone

Record the device facts, source and expected result. Make one reversible change, observe the outcome, and keep the evidence needed to undo it.