How to Detect Malware: Signs, Checks, and What to Do Next

To detect malware, watch for unusual behavior on your device, then scan it with a trusted security tool such as the one built into your operating system or Google Play Protect on Android. No single symptom proves an infection, so investigate anything you don't recognize: apps you didn't install, pop-ups, settings that change on their own or logins you didn't make.

This guide covers how to spot malware on computers and phones, what different types look like and what to do if you find something.

What is malware?

Malware is short for malicious software: software built to do harmful or unwanted things on a device.

It can reach you in several ways. You might download it through a malicious email attachment, a fake software update, a compromised website or an untrusted app. Sometimes clicking a deceptive link is enough to start the infection.

Different malware has different goals. Some of it tries to:

• Steal passwords or other credentials
• Monitor your activity
• Access personal information
• Encrypt files for extortion
• Use your device's resources
• Set up hidden access for later

What you'll notice depends on the malware, which is why detecting it isn't as simple as looking for one obvious symptom.

Also read: How to Check If a Website Is Safe to Browse

Signs you have malware

A slow computer doesn't automatically mean malware. Neither does a phone with poor battery life. But several unusual changes at once deserve a look.

Table: Common signs of malware on a device.

Each of these has other possible causes, and malware is only one of them. On a phone, check which apps use the most battery or mobile data. On a computer, look at network and system activity when something seems off.

Unusual account activity

Sometimes the clearest sign isn't on the device at all. You may notice:

• Password reset emails you didn't request
• Login alerts from unfamiliar locations
• Messages you didn't send
• Account settings you didn't change

These don't prove malware is present, but they can mean your credentials or accounts have been compromised. Our list of 12 signs you've been hacked goes through what to check.

How to check for malware on a PC

Start with the security tools already on your computer. On Windows, run a malware scan with your built-in security software. If it finds a threat, follow its recommended steps to quarantine or remove it.

Then check your installed applications and running processes for anything unfamiliar. Look for:

• Programs you don't recognize
• Processes using unusually high resources
• Software that starts automatically
• Browser extensions you didn't install

Don't kill a process just because its name looks strange. Plenty of legitimate system processes have technical names. If you're not sure what something does, look it up on a trusted source before you act.

Check your browser too

Malicious or unwanted browser extensions can change search results, redirect websites, show unwanted ads or collect information. Review your extensions and remove anything you don't recognize.

Also check your browser's notification permissions. A website you accidentally allowed to send notifications can produce behavior that looks a lot like malware.

How to detect malware on Mac

Macs aren't immune to malware. macOS has several built-in security layers, including Gatekeeper, Notarization and XProtect. Apple says XProtect can detect and block known malware, and can also remediate malware that has already run.

If you suspect malware on a Mac:

1. Install the latest macOS updates.
2. Review applications you don't recognize.
3. Check browser extensions and permissions.
4. Look for unusual login items or background activity.
5. Pay attention to unexpected security warnings.
6. Use a trusted security tool if you need a deeper look.

Don't assume a Mac is safe just because it runs macOS. The built-in protections are strong, but no operating system removes every risk.

How to check your phone for malware

The process depends on whether you use Android or iPhone.

How to detect malware on Android

Android includes Google Play Protect, which checks apps and devices for potentially harmful behavior. It can warn you about harmful apps and, in some cases, disable or remove them.

To check your Android device:

1. Open the Google Play Store.
2. Tap your profile icon.
3. Select Play Protect.
4. Review the security status and run a scan if prompted.
5. Make sure app scanning is turned on.

Google also recommends keeping Android and its security updates current. Be extra careful with apps installed outside Google Play: Google notes that apps from unknown sources can put your device and personal information at greater risk.

How to know if you have malware on your phone

Start with your installed apps. Ask yourself:

• Do I recognize every app?
• Did I install anything recently?
• Does an app have permissions it doesn't seem to need?
• Has battery or data usage changed unexpectedly?
• Is the phone behaving differently?

Check which apps use the most battery, storage or mobile data. Again, odd behavior is a reason to investigate, not proof of malware.

What about iPhone?

iPhones have strong platform-level security, and malware often isn't the explanation for odd behavior. If you're worried about an iPhone:

• Update iOS
• Review installed apps
• Check app permissions
• Review configuration profiles you don't recognize
• Remove apps you don't need
• Review your Apple Account for unfamiliar activity

If you get an unexpected security alert or account notification, verify it through Apple's official channels rather than following links in a suspicious message.

How to detect crypto mining malware

Crypto mining malware uses your device's computing power to mine cryptocurrency without your permission, which puts sustained load on your CPU or GPU. Possible signs:

• Unusually high CPU or GPU usage
• A device that gets hot when you're barely using it
• Fans running constantly
• Reduced performance
• Higher electricity use
• A battery draining unusually fast

Microsoft's threat description for one coin miner lists symptoms such as high CPU utilization and applications running very slowly.

Context is everything here. High CPU use while you edit video or play a demanding game is normal. High use while the device sits idle is worth a closer look.

How to detect infostealer malware

An infostealer is malware built to collect information from your device. Depending on the strain, that can include credentials, browser data, cookies or other sensitive information. Infostealers are hard to notice because most of their work happens in the background.

Look for:

• Unexpected security alerts
• Unknown login activity
• Passwords that suddenly stop working
• Unfamiliar sessions on your accounts
• Suspicious software or downloads
• Browser behavior that has changed

If you suspect an infostealer, don't assume removing the suspicious program is enough. Your credentials may already be out. Change passwords from a device you trust and turn on multi-factor authentication for important accounts. If you think financial or identity information was exposed, protect those accounts too.

How to detect fileless malware

Fileless malware may run without leaving a conventional malicious program on your device. Instead, attackers abuse legitimate tools, scripts or processes already on the system, which makes it hard to find by searching for suspicious files.

Signs can include:

• Unusual system processes
• Unexpected scripting activity
• Abnormal PowerShell or command-line activity on Windows
• Unexplained changes to system settings
• Network connections that don't fit normal behavior
• Security alerts based on suspicious activity rather than a known file

This is where behavioral detection matters. Looking only for known malicious files won't catch every kind of malicious activity.

How to detect Silver Sparrow malware

Silver Sparrow was a macOS malware activity cluster identified in 2021. It's a good example of why detection can go beyond searching for a suspicious app.

Researchers at Red Canary found Silver Sparrow activity involving macOS installer packages, JavaScript execution and persistence through LaunchAgents. Their published detection opportunities included suspicious use of PlistBuddy and sqlite3, and references to AWS S3 infrastructure.

Those are technical indicators for security professionals, not a checklist for everyday Mac users. The broader lesson is the useful part: some malware is identified by what it does, not what it's called. That's why security tools that analyze behavior complement traditional malware signatures.

What to do if you find malware

If a trusted security tool confirms malware, stop using the device normally and start with containment.

1. Disconnect if necessary

If you suspect an active compromise, take the device offline when you can. That limits communication between the malware and outside systems.

2. Follow your security software's recommendations

Use trusted security software to quarantine or remove the threat. Don't download random "malware removal" tools from pop-up ads.

3. Update your device

Install available operating system and security updates. They can close the holes the malware may have used.

4. Secure your accounts

If malware may have reached your passwords or browser data, change important credentials from a trusted device. Prioritize:

• Email
• Banking
• Password managers
• Work accounts
• Social media

Turn on MFA wherever you can.

5. Watch for further signs

Keep an eye on your accounts and device after the malware is gone. If suspicious activity continues, get professional security help.

Why malware detection takes more than one scan

A scan is useful, but it isn't the whole picture. Some threats are built to dodge traditional detection. Others get removed while the credentials or personal information they took stay exposed. Good security combines detection, investigation and response.

Keep your software updated, use trusted security tools and pay attention to unusual changes. You can't always stop malware from reaching your device, but you can make it harder for a compromise to stay hidden.

Knowing what's normal on your devices makes odd behavior easier to spot. Knowing what personal information is exposed tells you what an attacker could use if an account or device is compromised. Serus shows you which of your personal details are available online and takes action to reduce what can be found and exploited.

Run a free Serus scan to see which of your personal details are out there.