Delete these apps right now: The 2026 list of malicious Android and iPhone apps

August 31, 2026

By Kim Komando

Last year, I gave you 224 apps to delete. This year’s list is shorter but nastier. Twenty-eight of these apps sold the same scam under one name. Five hid a bank-login thief inside a PDF reader. Fifty planted a rootkit that survives a factory reset.

Every app on this page has been removed from Google Play or Apple’s App Store. But there’s a problem. Removal stops new downloads. It does not reach the copy already on your phone. If you installed any of these, it’s still there, still running.

Here’s what to do. Scroll the list, delete anything you recognize, then run the five-minute check at the bottom. And bookmark this page. I’ll keep it current.

Do this first (two minutes)

Android: Open the Play Store, tap your profile picture, tap Play Protect, tap Scan. Google says Play Protect automatically removes the worst of these once they’re flagged. Let it finish.

iPhone: There’s no equivalent scanner. Go to Settings > General > iPhone Storage, scroll the list and delete anything you don’t recognize or haven’t opened in months.

Now the list.

1. The “Call History” scam (28 apps, 7.3 million downloads)

Found by ESET in May 2026. These apps promised to show you anyone’s call log, texts or WhatsApp history for $6 to $80. They took the money through Google Play billing, credit cards and UPI, then handed back random gibberish. They went by nearly identical names, so here’s the rule: If the app name starts with “Call History,” delete it.

If you paid one of these, dispute the charge with your card or through Google Play’s refund page. You were sold nothing.

2. The bank account thieves (Anatsa droppers)

Found by Zscaler and Kaspersky between December 2025 and August 2026. These look like plain document readers. Once installed, they quietly download Anatsa, a banking Trojan that lays a fake login screen over 831 banking and finance apps, logs what you type and reads your texts for the verification codes. The tell: a PDF reader that asks you to “install an update” from inside the app.

If you had one of these, change your banking passwords from a different device, turn on a passkey or authenticator app, check your statements for transfers you didn’t make and freeze your credit at all four bureaus, so a stolen login can’t be used to open new accounts in your name. 

3. The rootkit that survives a factory reset (Operation NoVoice, 50+ apps, 2.3 million installs)

Found by McAfee in March 2026. These apps used old Android bugs to rewrite a core system file so every app on the phone runs the attacker’s code. It cloned WhatsApp sessions and stayed put through a factory reset. Google’s position: Phones with a security update from May 2021 or later were never vulnerable. If your phone can’t update anymore, this one is aimed at you.

Named by McAfee:

McAfee listed 47 more by package name only, including an “AirVPN,” a “BeautyCam,” a Ludo game and a pregnancy-exercise app. If your phone hasn’t had a security update in years and you have a no-name cleaner, VPN or game you don’t remember installing, that’s the one.

4. The camera apps with a backdoor (Keenadu, 300,000+ installs)

Found by Kaspersky in February 2026. Smart-home camera apps carrying a backdoor that can install other apps, grant itself permissions, read banking data and watch your incognito browsing. Kaspersky also found it baked into the firmware of cheap no-name tablets.

5. The subscription signers (Joker and friends, 19 apps)

Found by Doctor Web in quarterly sweeps from October 2025 through July 2026. These sign you up for premium services you never see until they show up on your phone bill. Fun fact: You never need a third-party “cleaner” app. Android and iPhone clean themselves.

Check your carrier bill for charges you don’t recognize and call to have them removed. Ask for a “third-party billing block” while you’re on the phone. If a charge on your bill doesn’t trace back to an app you remember installing, you may be a victim of phone-bill cramming, and there’s a way to get that money back. 

6. Fake money, casino fronts and hidden ads (7 apps)

Also from Doctor Web’s sweeps. Games that redirect to offshore casinos, “rewards” apps that never pay out and camera apps that spray ads.

7. iPhone: the crypto-wallet thieves

Found by Kaspersky in April 2026, plus a July lawsuit. Apple’s store isn’t immune, it’s just targeted differently. These posed as real crypto wallets, then captured the recovery phrase that unlocks everything.

Rule: A wallet app with a misspelled name is a thief with a typo.

The numbers you can’t see on this list

Some of the biggest campaigns this year never published app names, only technical package IDs. You can’t look them up by name, but you should know the scale:

The five-minute check

  1. Scan. Android: Play Store > profile > Play Protect > Scan. iPhone: delete what you don’t recognize.
  2. See who can read your screen. Android: Settings > Accessibility > Downloaded apps. If anything is switched on that isn’t a screen reader or your password manager, turn it off and uninstall the app. Then Settings > Apps > Special app access > Display over other apps. Same rule. Google started restricting these permissions in March 2026 because this is how most of the bank thieves and ad-fraud apps operate.
  3. Never install an “update” an app asks for inside itself. Trapdoor, the Anatsa droppers and the fake PDF readers all used a fake update prompt to pull the real malware after passing store review. Real updates come from the Play Store or App Store app only.
  4. Patch or retire. NoVoice only worked on phones with no security update since May 2021. Check: Android Settings > Security > Security update; iPhone Settings > General > Software Update. If there’s nothing newer, your phone has an expiration date, and it’s the target. 
  5. Be suspicious of the boring categories. Cleaners, PDF readers, file managers, wallpaper and camera apps, “call history” finders and wallet look-alikes. A food-delivery app has no business reading your whole photo library. Check the developer name, compare the review count to the install count, and read the app name twice.

🎯 Send this to someone who still has a “cleaner” or “battery saver” app they can’t remember installing. 

https://www.komando.com/news/security/delete-these-apps/