How to determine who has connected to your Android smartphone

The modern smartphone has become a digital extension of the individual, storing confidential data, passwords and personal correspondence. That is why the fear that an unauthorized person or malware may have gained access to your device is well founded. There are many scenarios: from malicious actions of a former partner to professional espionage using complex software like Pegasus or trivial Trojans hidden in free applications.

Determining the fact of an unauthorized connection is not always easy, since modern remote administration methods (RAT) are often disguised as system processes. However, Android has built-in logging and device management mechanisms that, with proper analysis, can identify anomalies. In this article, we will look at specific steps that will help you carry out a digital audit and regain control of your gadget.

Analysis of active sessions and connected devices

First of all, you need to check which devices are linked to your Google account. Hackers or ill-wishers often use the Find My Device feature or synchronization to gain access to geolocation and data. Go to your account security settings through a browser or application to see a list of all authorized gadgets.

Pay attention to device models that are unfamiliar to you. If Samsung Galaxy S21appears on the list, and you own Xiaomi Redmi Note, this is a clear sign of hacking. The system shows the device type, last login date and location. Suspicious activity from another city or country should be a reason for immediate action.

• 🕵️ Check the "Your devices" section in your Google account settings for unfamiliar models.
• 📍 Compare the geolocation of the last login with your real location at the time of activity.
• 📅 Pay attention to the login date and time: night sessions with the screen off are a warning sign.

⚠️ Attention: If you find an unknown device, immediately click the “Log Out” or “Remove Access” button next to it. After this, urgently change the password for your Google account and enable two-factor authentication.

In addition to your Google account, it is worth checking your Bluetooth and Wi-Fi settings. An attacker could try to connect to your phone directly through an access point or a Pairing request. Go to Settings → Connections → Bluetooth and view the list of paired devices. Delete all pairs that you did not create personally.

Searching for hidden spy applications in the system

The most common way to gain access is to install malware directly on the phone. Such apps are often disguised as harmless utilities: “Flashlight”, “Calculator” or “System Service”. They work in the background, intercepting calls, messages and transmitting data to a remote server.

To detect such apps, go to Settings → Applications → All applications. Please review the full list carefully. Look for applications without an icon, with a name consisting of a string of characters, or those that you definitely did not install. Pay special attention to apps with rights device administrator.

Malware often requires advanced rights to operate. Go to Settings → Security → Device administrator applications. There should only be the Find My Device service from Google or a corporate profile if the phone is working. The presence of an unknown application in this list is a critical threat.

If you find a suspicious item, try to remove it. If the "Uninstall" button is inactive, first revoke administrator rights in the corresponding menu, and then uninstall. In difficult cases, you may need to enter Safe Mode, which loads the system without third-party applications.

Monitoring charge and traffic consumption

Spyware and remote access apps require a constant connection to the Internet to transfer stolen data. This leads to abnormal consumption of mobile traffic and accelerated battery drain. Even in standby mode, the phone can consume resources if a hidden client is running in the background.

Open battery usage statistics in the section Settings → Battery. See which app is consuming the most energy. If you see a process with an unclear name or a system service that consumes 20-30% of the charge even though you have hardly used the phone, this is a reason for a detailed check.

Symptom	Normal behavior	Suspicious behavior
Background traffic consumption	Minimum (messengers, mail)	High (hundreds of MB without activity)
Case heating	Only when playing or charging	Heating in idle mode
Screen operating time	Corresponds to the time of use	The screen "worked" when the phone was lying down

Data consumption analysis also indicative. Go to Settings → Network and Internet → Data usage. Sort applications by the amount of information transferred. Spyware often transmits audio files and screenshots, which generates significant traffic. If the "Calculator" sent 500 MB of data in a week, this is an obvious virus.

Checking call forwarding and SMS

One of the most insidious surveillance methods - setting up forwarding of incoming calls and text messages to the attacker’s number. In this case, you will not notice any installed applications, but your calls will be duplicated, and confirmation codes from banks may go to third parties.

You can check the forwarding settings through the engineering menu or the standard dialer interface. Dial the code *#21# and press the call button. The forwarding status for voice, data, fax and SMS will appear on the screen. If next to any item there is a phone number that does not belong to you, it means that the connection has been intercepted.

To disable all types of forwarding, use the universal reset command. Enter ##002# and press call. The system should confirm that all conditional and unconditional redirects have been successfully disabled. This action is safe and does not affect your personal data or contacts.

⚠️ Attention: These USSD codes work on most mobile networks, but the display interface may vary depending on the operator and phone model. If the code does not work, check the forwarding settings in the "Phone" application menu.

It is also worth checking the list of trusted numbers and special operator services that could be activated through your personal account or by a call from scammers. Some operators provide the Anti-Spy service or details of connected services, where you can see active redirects.

Diagnostics of access rights and special features

Modern Trojans often use legitimate Android functions to gain complete control. The key tool here is the Accessibility (Accessibility) section. Malicious apps request access to this section in order to emulate button presses, read text on the screen, and bypass protections.

Go to Settings → Accessibility. Carefully review the list of installed services. Any service that has permission to control the screen or read content must be personally installed by you and understood by you. Names like "Update Service", "Wi-Fi Helper" or just a set of letters often indicate malware.

What does malware do in accessibility?

Having access to accessibility features, the app can automatically click the "Allow" button when prompted rights, intercept password input from the keyboard and block notifications from antivirus apps.

Another important attack vector is the right to install applications from unknown sources. Check which apps you have given this permission to. Go to Settings → Applications → Special access → Installing unknown applications. There should be no active permissions for browsers, instant messengers or file managers, unless you are manually installing software right now.

Also check the ability to overlay windows on top of other applications. This allows attackers to create fake bank or social media login windows on top of real applications to steal your credentials. Disable this feature for all suspicious apps.

Radical measures: reset and protection

If you find multiple signs of hacking, but cannot find the source of the threat, or if the phone behaves unpredictably, the most reliable solution is a full reset to factory settings. This is guaranteed to remove any third-party software, including deeply hidden root access and system modifications.

Before performing a reset, be sure to save important data (photos, contacts) to an external drive or to the cloud, but Do not save a backup copy of installed applicationsas you can restore the virus along with the data. After the reset, set up your phone as new by logging into your Google account.

Settings → System → Reset settings → Delete all data

After returning the phone to a clean state, immediately change all critical passwords: from Google, social networks, banking applications and email services. Do this only from a trusted device if you have doubts about the cleanliness of the main phone immediately after the reset.

⚠️ Attention: Before resetting, make sure you remember the password for your Google account. After the reset, FRP (Factory Reset Protection) protection will work, and without entering the login and password of the account that was synchronized earlier, it will be impossible to turn on the phone.

Frequently asked questions (FAQ)

Can someone connect to the phone via Wi-Fi?

Direct connection to the file system via Wi-Fi is unlikely without installing special software on the phone. However, if you are connected to the same network as a hacker, they can intercept your unencrypted traffic (sniffing). Always use a VPN on public networks.

Will an antivirus show the presence of a surveillance app?

Not always. Many professional spy apps (stalkerware) have digital signatures or use bypass methods that allow them to remain invisible to standard security scanners, such as Google Play Protect.

What if the phone turns on the screen or opens applications on its own?

This is a sure sign of malware with administrator rights or access to special features. Immediately turn off the Internet, go into safe mode and remove recently installed applications or perform a factory reset.

Is it safe to enter banking information if I suspect hacking?

Absolutely not. If spyware is suspected, the keyboard may be compromised (keylogger). All entered characters, including passwords and CVV codes, can be sent to attackers in real time.

How to protect your phone from being hacked again?

Set a strong password or biometric protection, do not follow links from SMS from unknown numbers, download applications only from the official store Google Play and regularly update the Android security system.