How antivirus actually works on a phone
The word "antivirus" is a legacy name. The bulk of what reaches an ordinary phone is not a classic virus: it is a credential-phishing message, a trojanised installer from a sideloaded file, a stealer bundled inside a cracked app, or ransomware delivered through one of the three. How each of those is caught — and where each detection method goes blind — is the whole of this page.
The three ways a threat gets identified
1. Signatures: exact, cheap, blind to the new
Signature matching compares a file or app against a catalogue of known-bad patterns. It is exact and fast, which is why it is the cheapest layer in any product. It is also structurally blind to anything written after the last catalogue update — a signature database cannot contain a file that does not exist yet.
2. Reputation: who published it, and what did it do
Store-based reputation works on provenance: an app's publisher, its download history, and reported behaviour. This is what catches the trojanised installer that no signature catalogue has seen. Its blind spot is a brand-new publisher with a clean history, and anything installed outside the store that the reputation system never saw.
3. Behaviour: what the process does, not what it is called
Behaviour monitoring watches for sequences of actions that legitimate apps rarely make — reading the SMS inbox, copying every contact, waking on a timer, exfiltrating over the network. It catches unknown malware that signature and reputation both miss, and it causes most false positives, because a legitimate app can sometimes look like a stealer for a few seconds.
Where a web filter sits
Web and link filtering is a separate mechanism that runs in the browser layer: it checks addresses against reputation lists before the page loads. This is where most phishing is caught, because a phishing page does not need a malicious app to exist at all — it needs a reader to open a link. The filter's limits are the same as any reputation system: it cannot see a brand-new address, and it cannot protect a message opened outside the browser it covers.
What no phone product can do
- Nothing about an account takeover that happens on someone else's server. If a service you use is breached, the software on your phone is irrelevant.
- Recover files that are already encrypted, or an SMS code you already typed.
- Make you anonymous on the networks you join. That is a VPN's job, and a VPN does not block malware either — see features explained for the split.