How to Check iPhone for Malware: 8 Checks + What to Do

Check iPhone for malware in about ten minutes, with no app to install. Real iPhone malware is rare, but it isn’t impossible. In 2026 a crypto app on the official App Store turned malicious in an update, and attackers chained iOS flaws to steal wallet data from iPhones that hadn’t been updated. This guide shows the checks that actually find problems, the “signs” that usually mean nothing, and exactly what to do if something is wrong.

Can an iPhone Get Malware?

It can, but it’s much harder than on a computer. Apple says all third-party apps are sandboxed, which is designed to stop an app from reading or changing other apps’ data or making changes to the device. Every App Store app is also reviewed by Apple’s App Review team before it’s published (Apple).

That’s also why “antivirus” apps for iPhone can’t scan your phone the way they would on a PC: the sandbox stops them from looking inside other apps. What does get through, in practice, is one of these:

• A bad app that slipped past review or turned malicious in a later update.
• Unpatched iOS flaws, used by attackers against phones that haven’t been updated.
• A configuration profile you were tricked into installing, which can change settings or route your traffic.
• Scams that need you to act: fake pop-ups, phishing links and messages asking for your password or code.

The last one is by far the most common, and no app can protect you from it. The checks below cover all four.

How to Check iPhone for Malware: 8 Checks

Work through these in order. Most people find nothing, and that’s the normal result.

1. Update iOS

Go to Settings → General → Software Update. Updates close the holes attackers use. The current version, iOS 27.2.1 (November 9, 2026), fixed 9 security issues, including Bluetooth pairing and iMessage group-chat flaws. Only update here, never from a link or a file someone sends you.

2. Look for apps you don’t recognize

Swipe left past your last Home Screen page to the App Library and scroll through it. Then in the App Store, tap your profile picture → Apps (or Purchased) to see everything your account has downloaded. Delete anything you didn’t install or no longer trust. If an app has already done harm, report it at reportaproblem.apple.com. Apple says it investigates and removes apps found to be malicious (Apple).

3. Check for configuration profiles

Go to Settings → General → VPN & Device Management. If you don’t see any profiles, none are installed. If you see one you don’t recognize, tap it, tap Delete Profile, then restart. If the iPhone belongs to your work or school, ask them first, because deleting a profile also removes its settings, apps and data (Apple).

4. Clean up Safari

Go to Settings → Apps → Safari and turn on Block Pop-ups and Fraudulent Website Warning. Apple warns that some pop-ups pretend to be from Apple and use fake close buttons, so close the tab instead of tapping inside them (Apple).

5. Remove spam calendars

Strange events with links (“Your iPhone is infected!”) usually come from a calendar subscription, not malware. In Calendar, tap Calendars, tap the ⓘ next to the one you don’t recognize and choose Unsubscribe or Delete Calendar. For a single junk event, tap it, then Report Junk (Apple).

6. Check your Apple Account

Go to Settings → [your name] and scroll to the device list, or sign in at account.apple.com → Devices. Remove any device you don’t recognize and change your password. Apple lists the signs of a compromised account: sign-in alerts you don’t recognize, two-factor codes you didn’t ask for, messages you didn’t send, or a password that suddenly stops working (Apple). If Apple keeps asking you to sign in, see Apple ID sign-in requested keeps popping up.

7. Run Safety Check

Go to Settings → Privacy & Security → Safety Check. Manage Sharing & Access shows which people and apps can see your location, photos and other data, and lets you stop each one. Emergency Reset stops all sharing at once. It needs two-factor authentication and doesn’t cover non-Apple accounts like social media (Apple).

8. Lockdown Mode, only if you could be targeted

Lockdown Mode is an extreme, optional protection for people who may be singled out by sophisticated attacks, such as journalists or activists. Apple says most people are never targeted this way. If that’s you, turn it on in Settings → Privacy & Security → Lockdown Mode (Apple). Apple also sends threat notifications, in Settings and by email, to people it believes were targeted by mercenary spyware (Apple).

Signs That Usually Aren’t Malware

Most “my iPhone is hacked” checklists list symptoms that almost always have a normal cause. Before you worry, rule these out:

• Battery draining fast, especially for a few days after an update. See iOS 27 battery drain and which apps actually drain your battery.
• Getting warm while charging, gaming or after an update. See iPhone overheating.
• Running slow. Usually storage or an aging battery. See iPhone running slow.
• Pop-ups in Safari saying your iPhone is infected. Those are ads, not a diagnosis, and Apple lists them as a scam tactic (Apple).
• Apps crashing after an update. That’s usually a bug, not an attack.

What deserves attention are things you didn’t do: apps or profiles you didn’t install, messages you didn’t send, sign-in alerts or codes you didn’t request, or purchases you don’t recognize.

Clicked a Suspicious Link? Do This

Opening a link usually isn’t enough to infect an updated iPhone. The danger is what the page asks you to do. Close the tab, then think about what happened next:

• You only looked at the page: close it and make sure iOS is up to date. That’s usually all.
• You typed a password: change that password now, starting with your Apple Account and email, and turn on two-factor authentication.
• You installed a profile or app it offered: remove it using checks 2 and 3 above.
• You gave card or bank details: call your bank using the number on your card.

Apple’s rule of thumb: it will never ask you to sign in to a website, read out a two-factor code, or turn off a security feature like Stolen Device Protection. Anyone who does is a scammer (Apple).

Found a Malicious App? What to Do

1. Delete the app or profile.
2. Update iOS and restart.
3. Change your passwords for anything you used in that app, starting with your Apple Account, and remove unknown devices from account.apple.com.
4. Report the app at reportaproblem.apple.com.
5. If it handled money or crypto, contact your bank or wallet provider. Deleting an app doesn’t undo anything it already copied.

Real Examples: FomoPeek and DarkSword

Two real cases from 2026 show how iPhone malware actually works, and how ordinary checks stop it.

FomoPeek was a crypto-tracking app on Apple’s official App Store. According to security firm SlowMist, as reported by crypto.news and TheStreet, version 1.0 was clean, but versions 1.1 and 1.2 carried code that could steal private keys and seed phrases. Version 1.3 removed it. Binance told iPhone users to delete the app, update iOS, and move self-custody funds to a new wallet set up on a clean device. The lesson: an app you trusted can change in an update, so review your apps now and then (check 2).

DarkSword is an attack kit that chains six iOS flaws, three of them zero-days when found, against iPhones on iOS 18.4 to 18.7. It steals files, passwords from the Keychain and crypto wallet data, according to SlowMist and The Hacker News. Apple has patched all six flaws, so an updated iPhone isn’t affected. The lesson: updating (check 1) is the single most effective protection.

When to Erase Your iPhone

Erasing your iPhone is the last resort, for when you’ve done every check above and still see activity you can’t explain, or when you can’t remove something. Go to Settings → General → Transfer or Reset iPhone → Erase All Content and Settings. Afterwards, set it up as new, or restore a backup made before the problem started, so you don’t bring the problem back. Back up your photos first, using Apple’s backup guide.

Frequently Asked Questions

Can an iPhone get a virus from a website?
It’s very rare on an updated iPhone. Real attacks through websites, like DarkSword, use flaws that Apple has since fixed, which is why updating matters. The common danger is a page that tricks you into typing a password or installing a profile.

Do I need an antivirus app on my iPhone?
No. Because every app is sandboxed, an iPhone “antivirus” app can’t scan other apps. Keep iOS updated and run the checks above instead. Never install one from a pop-up.

How do I know if my iPhone is hacked?
Look for things you didn’t do: unknown apps or profiles, messages you didn’t send, sign-in alerts or two-factor codes you didn’t request, or your Apple Account password no longer working. Battery drain on its own is usually not a sign.

Is the “your iPhone has a virus” pop-up real?
No. Apple lists pop-ups claiming your device has a security problem as a scam tactic. Close the tab and don’t tap anything inside it.

Should I turn on Lockdown Mode?
Only if you think you could be personally targeted by a sophisticated attack, for example because of your job. It limits many features, and Apple says most people are never targeted this way.