How to check your Android storage for hidden APK files
Find APK files hiding in Downloads, WhatsApp and other folders on your Android phone, and delete the ones you did not choose to install.
An APK is an Android app installer. Scammers send fake bank, challan and KYC apps as APK files, and they land in your Downloads or WhatsApp folder. Deleting them removes the risk of a later tap. A quick look through storage will find them. Menu names differ slightly on Samsung, Xiaomi, Vivo, Oppo, Realme and OnePlus phones.
Steps
- Open the Files app. Open the Files app from your app drawer. If you do not have one, search Settings for Storage and tap Files or Browse. Avoid downloading a file manager from an unknown source just for this.
- Look in Downloads. Tap Downloads. Sort by type or use the search bar and type .apk. Look for files that end in .apk or names such as update, KYC, RTO or challan. Anything you did not knowingly download should go.
- Check WhatsApp and Telegram folders. Search again inside the WhatsApp Documents folder, Telegram folder and any Bluetooth or Share folders. Files sent in chats are saved there, including APKs from friends whose accounts may have been hacked.
- Delete suspicious files. Select the APK, tap Delete and confirm. Do not tap the file to open it. If you already installed one, uninstall the app from Settings, Apps, and see our guides on Device admin and Accessibility.
- Stop it happening again. Turn off Install unknown apps for your browser, WhatsApp and file manager, and keep Play Protect on. See our Install unknown apps guide for steps. Delete future APKs as soon as they arrive.
Menu names differ a little between phone makers and Android versions. If you cannot find a setting, open Settings and use the search box.
Why it matters
A fake app in storage is harmless until someone taps it, and then it can ask for permissions and read your OTPs. Messages saying your bank KYC or challan service will stop unless you install the attached file are common. Clearing these files removes the temptation and the risk of an accidental install.
Watch out for
- Some APKs are renamed to look like images or PDFs.
- A file called Update or Bank KYC.apk from a contact may be malware.
- Never install an APK to claim a refund or avoid a fine.
- Cloud backups can restore old files, so check again after restoring.
How Safeavio helps
Safeavio's phone scan reviews installed apps and flags those outside a store, copies of other apps and risky settings like unknown sources, so you can catch a fake that was already installed. Link check looks at a link before you open it. It does not scan every file in your storage.
Check it before you tap or pay
Safeavio Sentinel is a made-in-India Android app: paste a message or link, or scan a QR code, and get a plain verdict with the reasons. It helps you spot a scam; it does not promise to stop every one.
Download for AndroidWhat the app does
Google Play listing: coming soon. Today the signed APK is on safeavio.com/download. Android 7.0 or later.
Questions
Is every APK dangerous?
No. Some are legitimate apps from makers' own sites. But if you did not choose it, or it came through a chat, SMS or call, treat it as unsafe and delete it.
Can an APK harm the phone if I do not open it?
Not by itself. Danger starts when it is installed. Still, delete unknown ones so nobody, including a child or you in a hurry, installs one by mistake.