How to Uninstall a Hacked Phone (iOS and Android)

Almost every guide to a hacked phone ends the same way: factory reset it. That advice is not wrong, but it is incomplete in two directions that matter. A reset can destroy the evidence you need if the intrusion turns out to be a person you know, an employer, or a soon-to-be ex-partner — and a reset often fails to remove the intrusion at all, because the phone is restored from a backup that still contains the malicious profile, the rogue app, or the management enrollment that let the attacker in.

This guide is the order of operations we use on real device-compromise cases: identify what kind of compromise you are dealing with, capture what you need, remove the intrusion properly on Android or iOS, reset only when a reset is the right tool, and verify over the following week that it stayed gone. Where the job needs forensic imaging or a written report, we say so — that is the point at which a device-compromise consultation is cheaper than a second guess.

What "hacked" actually means on a phone

"Hacked" describes at least four different problems with four different removal paths. Getting the category wrong is why people uninstall an app, feel safe, and get compromised again a week later.

What you are seeing	What it usually is	Removal path
Battery drain, heat, data usage, unknown apps appearing	Malware or "monitoring" app installed on the device with consent of the OS (often by someone with physical access)	App and permission removal, then verify — usually no reset needed
Weird logins, password resets, messages sent from your accounts, contacts receiving links	Account takeover — the phone is fine, the accounts are not	Session revocation, password reset, 2FA rebuild; the phone only matters as a token store
Phone behaves normally but someone knows your location, calls or messages	Stalkerware, a carrier-level feature, a shared family account, or a cloud account with device access	Device profile audit, account audit, carrier check
Phone is "managed", settings are greyed out, you cannot remove a profile	Mobile device management (MDM) enrollment, supervision, or a work profile	MDM removal through the owning organization, or a supervised-device wipe

The distinction matters because uninstalling is only a complete fix for the first and, partially, the fourth. If the intruder has your email, removing an app from your phone does nothing except tell them you noticed. If you are not yet sure the phone is compromised at all, start with the 15 warning signs of a hacked phone and come back here once you have a symptom that points to the device rather than the account.

Before you uninstall anything: capture evidence

Five minutes of screenshots can be the difference between a clean resolution and an unwinnable argument. If there is any chance this becomes a legal matter — a family situation, a business dispute, a protective order, an employment issue — do this first, and do not post about it.

1. Screenshot the app list and settings that look wrong. On Android: Settings → Apps → See all apps, sorted by install date. On iPhone: Settings → General → VPN & Device Management, and Settings → Screen Time.
2. Screenshot account activity. Google: myaccount.google.com → Security → Your devices. Apple: appleid.apple.com → Devices. Bank and social accounts have equivalents.
3. Note dates and times, not just what you saw. A timeline is the single most useful artifact in a real case.
4. Do not factory reset yet if the device may be evidence. A reset wipes exactly what an investigator would image.
5. Change passwords from a different device, not the suspect phone, if you believe the phone itself is compromised. A keylogger on the device captures the new password as you type it.

If you are in immediate danger, contact local emergency services before touching any settings. Device cleanup can wait; safety cannot.

How to uninstall a hacked app on Android

Android gives you several legitimate paths for removal, and attackers rely on you not knowing which one applies. Work through them in this order.

1. Revoke device administrator access

A malicious app with device-admin rights cannot normally be uninstalled — the button is disabled. Go to Settings → Security → Device admin apps (on some devices: Settings → Biometrics and security → Other security settings → Device admin apps). Look for anything you did not enable, or any app whose name is generic ("System Service", "Device Care", "Sync Framework"). Tap it, then Deactivate, then uninstall the app normally.

2. Cut accessibility, notification and usage access

Accessibility services can read the screen, simulate taps, and capture everything displayed — including passwords and one-time codes. Notification access can read every message preview, including bank OTPs. Go to Settings → Apps → Special access (or Special app access) and check Accessibility, Notification access, Usage access, and Display over other apps. Remove anything you do not recognise.

3. Uninstall from safe mode

Some apps reinstall themselves through a second package or a background service. Boot into safe mode (hold power, long-press Power off until Safe mode appears, then confirm) so only system apps run, then uninstall the suspect app from Settings → Apps. Reboot normally and confirm it has not returned.

4. Audit unknown-source installs and Play Protect

Check Settings → Apps → Special app access → Install unknown apps and see which apps are permitted to install packages. Then open the Play Store, tap your profile icon → Play Protect → Scan. Play Protect catches known malware, not bespoke spyware, so treat a clean scan as weak evidence rather than a guarantee.

5. Check for a work profile and hidden users

An app in a work profile does not appear in your personal app list. Look at Settings → Passwords & accounts for a work profile, and check Settings → System → Multiple users for an extra user account you did not create. Both are legitimate features that are also abused.

6. Look for root

A rooted phone can hide apps from the launcher entirely. Check with a root-checking app, or look for Magisk, SuperSU, or an unlocked bootloader warning at startup. A rooted phone cannot be trusted after a compromise: reflashing the stock firmware is the only reliable cleanup.

7. If the app returns after uninstall

That means something else is still running: another package, a persistence service, a management profile, or a restore from a cloud backup. Stop uninstalling and start the incident triage instead — repeated reappearance is the signal that the device needs analysis, not another tap.

How to remove a malicious profile on iPhone

iPhones are harder to compromise with a random app and easier to compromise with a profile. Most "my iPhone is hacked" cases we see involve one of four things: a configuration profile, a management enrollment, a Screen Time restriction trick, or an account-level takeover.

1. Configuration profiles

Go to Settings → General → VPN & Device Management. Under Configuration Profile, anything that is not from your employer or your mobile carrier is suspect. Tap it → Remove Profile and enter your passcode. Pay attention to two specific profile types: a web content filter or DNS proxy profile (used to route your traffic through someone else's server) and a root certificate (used to intercept encrypted traffic). Certificate authorities live under Settings → General → About → Certificate Trust Settings.

2. Device management and supervision

If the phone shows a Device Management entry naming an organization, the device is enrolled in MDM. An organization that legitimately owns the device can push apps, read location, and wipe it. If you do not recognise the organization, do not simply delete the profile: a supervised device will re-enroll, and on some configurations removal requires the organization to release the serial number. This is one of the few situations where you need the device forensics team rather than a settings change, because the same enrollment can be re-created silently.

3. Screen Time restrictions

Screen Time is a favourite hiding place because a restriction can block the removal of profiles, prevent app deletion, and lock settings — and it is controlled by a passcode that is not your unlock code. Check Settings → Screen Time → Content & Privacy Restrictions. If a Screen Time passcode exists that you did not set, that alone is a strong indicator of physical-access tampering.

4. Apple ID devices and sessions

Open Settings → [your name] and scroll through the device list. Remove anything you do not recognise, then change the Apple ID password from a clean device. Also check Settings → [your name] → Sign-In & Security for trusted phone numbers and trusted devices that are not yours — an attacker who keeps a trusted device can approve password resets.

5. Update, then check again

iOS zero-click exploits are patched quickly, but only if you install the update. Go to Settings → General → Software Update and install the current version. If the device is several major versions behind and you suspect a remote compromise rather than an app, updating is the single highest-value action.

Why the malware comes back after a factory reset

A factory reset erases the device, not your account. Three things routinely reintroduce the intrusion.

• Full backup restore. Restoring an iCloud or Google backup brings back the profile, the app, and sometimes the enrollment. Restore photos, contacts and messages — never the full device backup — when you are cleaning up after a compromise.
• Account-level persistence. If the attacker still has your email, they can re-add a device, re-approve a login, or re-install a management profile through an account you control but they can access.
• Automatic re-enrollment. Supervised iOS devices and Android devices enrolled in an MDM will re-apply their management profile on first boot, straight from the enrollment record.

That is why the order below matters more than any single step.

Reset it cleanly, in this order

Step	What to do	Why
1	Change the password on your primary email from a different device	Email is the reset path for everything else
2	Enable app-based 2FA and save recovery codes offline	Stops re-entry even if the password leaks again
3	Revoke all sessions on Google, Apple, Microsoft, social and banking accounts	Kills tokens the attacker is holding
4	Sign the phone out of your accounts	Removes the device as a trusted token holder
5	Back up photos and documents only	Avoids restoring the payload
6	Erase all content and settings (iPhone) or factory reset (Android)	Clears apps, profiles and configuration
7	Do not restore a full backup	The most common cause of reinfection
8	Sign in fresh, install apps from the store only, then re-check profiles	Verifies the clean state before you use it

On iPhone, use Settings → General → Transfer or Reset iPhone → Erase All Content and Settings. On Android, use Settings → System → Reset options → Erase all data (factory reset). If the phone is rooted, jailbroken, or supervised, a factory reset from settings is not sufficient — the firmware itself needs reinstalling, which is a workshop job.

Also contact your carrier if you suspect a SIM swap: ask for the current SIM serial on record, disable any forwarding codes (*21# on many networks shows active forwarding; ##21# clears it), and ask whether a replacement SIM or eSIM was recently issued. A SIM swap defeats SMS-based 2FA no matter how clean your phone is.

Take back the accounts the intruder touched

Uninstalling is only half the job; the accounts are the prize. Work through this list once, in this order.

• Email first. Check forwarding rules, filters, delegation, and "send as" aliases. A hidden forwarding rule that copies your mail to another address survives every password change.
• Recovery details. Remove unknown recovery emails and phone numbers, then add your own.
• Connected apps. In Google, review Security → Third-party apps with account access; in Apple, review Sign-In & Security → Apps Using Apple ID. Revoke anything unfamiliar — OAuth grants do not need your password.
• App passwords and API tokens. Revoke all of them and issue new ones only where needed.
• Banking and payment. Notify the bank, check for new payees, and review device authorisations in the banking app.
• Social accounts. Check active sessions, logged-in devices, and any linked business or ad accounts. Account-takeover scams often start with a fake profile that mirrors your contacts — our guide to spotting fake social media accounts covers what the attacker does with that access.
• Password manager. If your vault was accessible from the compromised phone, rotate the master password and every credential in it, highest-value accounts first.

For email accounts that are already lost — recovery address changed, 2FA replaced — start with the provider's account-recovery process, and expect it to take days. We handle these routinely; see Gmail and Google account recovery for the sequence that works when the standard form fails.

Verify the phone is actually clean

Do not declare victory on the day you uninstall. Watch for seven days against a baseline you recorded at the start.

Day 0: no unknown apps, no unknown profiles, no device-admin entries, no MDM enrollment, signed out of all accounts except the ones you re-added.

Day 1: check battery and data usage against your pre-incident baseline. A monitoring app that survived will show up as background usage under a generic name.

Day 3: re-check the app list, profiles, accessibility services, and account devices. Re-infection usually appears inside 72 hours if the persistence mechanism is still there.

Day 7: review login alerts, bank statements, and message history. If nothing anomalous appears and the device state matches Day 0, you can treat the device as clean.

If the same indicators return, stop cleaning and preserve the device. That pattern — reinstallation after a full wipe — is the strongest single indicator that the device needs forensic analysis rather than another reset.

When doing it yourself is the wrong move

Self-cleanup is the right call for a phone that picked up a malicious app, a bad profile, or a compromised account. It is the wrong call in five situations:

1. The intruder had physical access and you may need evidence. Reset destroys it. Imaging first preserves the timeline, the app artifacts and the enrollment records — see what a mobile forensic examination actually recovers.
2. The phone is managed by an employer or a school. Removing a management profile from a device you do not own can breach policy or an employment contract. Get the enrollment record and the policy in writing.
3. The intrusion keeps returning. Persistence across a wipe means firmware-level or enrollment-level control, which needs analysis, not settings work.
4. It is a family or relationship case. These are the cases where evidence quality decides outcomes, and where the technical work has to be done without tipping off the other party.
5. The compromise touched business accounts, client data, or money. That is an incident-response matter with notification obligations, not a phone problem.

What a consultation actually gives you

A device-compromise consultation with our team is scoped in three steps, and the first one is a triage call where we tell you whether you need us at all.

• Triage (same day): what kind of compromise this is, what to preserve, what to stop doing immediately.
• Analysis: device and account review — profiles, enrollment records, installed packages, account sessions, email rules, backup contents — and a written timeline of what happened and when.
• Remediation and verification: removal sequence for your specific setup, the reset-and-restore plan that will not reintroduce the intrusion, hardened account settings, and a short verification checklist you can run yourself afterwards.

Everything we do is on devices you own or are authorised to administer, with your written consent. We do not install monitoring software, we do not access accounts you do not control, and we do not work on a device someone else owns without their authorisation. If your case needs law enforcement, we will tell you that instead of taking the job. Book a cell phone forensics consultation or contact us with the short version of what happened — device model, what you noticed, and when it started. That is enough for triage.

FAQ

Can I remove spyware from my phone without a factory reset? Usually yes, if the intrusion is an app, a configuration profile, a device-admin grant, or an accessibility service. Uninstall it, revoke the permission, and verify for a week. A reset is needed when the phone is rooted or jailbroken, when the profile is enforced by management enrollment, or when the same indicators return after removal.

Does a factory reset remove a hacker from my phone? It removes apps, profiles and settings — but it does not remove account access, and it does not survive a full backup restore. People get reinfected because they restore the backup that contained the malicious profile, or because the attacker still has their email and re-adds a device.

How do I know if my phone is actually hacked? The reliable indicators are concrete: an app you did not install, a configuration profile you did not add, a device-admin or accessibility grant you did not give, a Screen Time passcode you did not set, login alerts from your accounts, or battery and data usage that jumps without a new app. Vague symptoms like "it feels slow" are not diagnostic on their own.

Can someone hack my phone without touching it? Yes — through your account rather than your device. If an attacker has your email and password, they can approve a device, add a recovery address, or read your backups without ever holding the phone. Zero-click exploits against the operating system exist but are rare and expensive; account takeover is common and cheap.

Will uninstalling the app remove their access to my accounts? No. Session tokens live on their side until you revoke them. Uninstalling changes nothing about an active session on another device, a forwarding rule in your email, or an OAuth grant to a third-party app. Do the account section as well.

Will I lose evidence if I reset the phone? Yes. A reset removes the app artifacts, profile records and logs that establish what was installed and when. If the case may become legal — family, employment, protective order — capture screenshots and get the device imaged before you wipe it.

How long does a professional cleanup take? Triage is same-day. A typical analysis and remediation cycle runs two to five working days, depending on whether the device must be imaged and whether accounts need recovery through a provider. Cases involving a supervised device or a disputed ownership claim take longer because records have to be requested.

Can you remove spyware that someone else installed on my phone? Yes, on a device you own or are authorised to administer — that is exactly the work. We will not help install monitoring software on someone else's device, and we will not access an account you do not control. If you are the account holder and the device is yours, the case is straightforward.

Where to go next

The short version of this guide: identify which of the four compromises you have, capture evidence before you delete anything, remove the app or profile properly, fix the accounts as carefully as the phone, and do not restore a full backup. Most phones come out of that clean. The ones that do not are the ones where the intrusion lives above the app layer — in a management enrollment, in the firmware, or in an email account someone else still controls.

If you are in that second group, or if you simply want the device checked by someone who does this daily, talk to our team. For the platform-specific side of the same problem, see cell phone forensics on devices you own and phone compromise response; for hiring questions and how engagements are structured, start with hire an ethical hacker.