Your phone is processing requests right now that you never sent. Not because it's updating apps or syncing photos — because someone else is using its CPU, memory, and internet connection for their own purposes. This isn't hypothetical. According to CISA, botnets — networks of hijacked civilian devices — are among the most persistent infrastructure threats, routinely used for fraud, cyberattacks, and large-scale data theft. Your device could be one node in that network right now.
1. How Your Devices Can Be Hijacked Without You Knowing
Attackers don't need your password. They need a single point of entry — a sideloaded app, a malicious PDF attachment, an unpatched browser, or even a compromised Wi-Fi router that injects code into your traffic before it reaches you.
Once inside, the malware operates silently. It doesn't crash your device dramatically. That would get it removed. Instead, it throttles its own activity — running at 3am, borrowing just enough bandwidth not to trigger your data alerts, and disguising its processes under legitimate-sounding names like svchost.exe (Windows) or com.android.providers.media (Android).
The three most common hijacking mechanisms targeting everyday devices:
- Botnet enrollment: Your device becomes a soldier in a distributed army, used to send spam, conduct DDoS attacks, or brute-force other accounts.
- Cryptojacking: Your hardware mines cryptocurrency for someone else. No ransomware note. No warning. Just silent electricity theft and premature hardware wear.
- Proxy abuse: Your IP address is rented out (sometimes through apps you consented to, buried in a ToS) to route criminal traffic, making it look like crimes originate from your location.
That last one is particularly underappreciated. Some "free VPN" apps explicitly sell your bandwidth to proxy networks. The FTC has flagged deceptive disclosure practices in this space. You agreed to it — technically — somewhere in paragraph 34 of a EULA you didn't read.
2. Why Being a Secret Helper for Criminals Matters to You
The instinct is to think: "So what? It's not my crime." That framing is wrong on two levels.
Legal exposure is real. Law enforcement traces attacks to IP addresses first. If a cyberattack on a bank originates from your home network, you are the first door they knock on. Proving you were the unwitting host — not the actor — takes time, lawyers, and seized hardware.
Your data is also at risk. Malware that uses your device as infrastructure almost always has a secondary payload: credential harvesting. Your saved passwords, banking sessions, and stored card numbers are collateral targets. The criminal using your device as a proxy is also reading your traffic.
There's also the hardware cost. Cryptojacking measurably shortens device lifespan. A processor running at 80-90% continuously for months degrades faster. You pay for that in early replacements.
3. Easy Signs That Your Phone or Computer Is Being Used Illegally
No single symptom is conclusive. The pattern is what matters. Watch for these in combination:
- Device runs hot when idle or charging
- Battery draining faster than usual with no new apps installed
- Data usage spikes, especially overnight
- Fan running constantly on a laptop doing nothing
- Sluggish performance on tasks that used to be instant
- New browser extensions you didn't install
- Antivirus or firewall settings changed or disabled
On Windows, open Task Manager and sort by CPU usage. Anything consuming significant resources that you don't recognize is worth investigating. Cross-reference the process name against Microsoft's official process list — malware commonly impersonates legitimate system processes with slight misspellings (e.g., svch0st.exe vs svchost.exe).
On a Mac or Linux machine, run this in Terminal to surface processes consuming the most CPU:
ps aux --sort=-%cpu | head -20On Android, go to Settings → Battery → Battery Usage and look for apps consuming power in the background that you haven't actively used. On iOS, Settings → Privacy & Security → check which apps requested background refresh without obvious reason.
For network-level inspection on Windows, this command shows every active connection and the process ID behind it:
netstat -ano | findstr ESTABLISHEDThen map the PID (process ID) in the last column back to a process name in Task Manager. If you see connections to unknown foreign IPs from a process you can't identify — that's a flag.
4. Take Back Control: Steps to Secure Your Device Right Now
Speed matters here. Every hour a botnet client runs on your device is an hour your IP is being logged in criminal infrastructure logs somewhere.
| Action | Platform | Priority |
|---|---|---|
| Run a full scan with Malwarebytes (free tier works) | Windows / Mac | Immediate |
| Revoke background app permissions | Android / iOS | Immediate |
| Update OS and all apps — patch the entry point | All | Immediate |
| Change router admin password and update firmware | Home network | High |
| Audit browser extensions — remove anything unrecognized | Desktop browsers | High |
| Enable 2FA on all accounts — compromise often extends to credentials | All accounts | High |
| Check Have I Been Pwned for your email address | Web | Medium |
| Factory reset if infection persists after scanning | All | Last resort |
Don't reinstall from a backup made before you identified the infection. If the malware predates your last backup, you'll restore it. Do a clean OS install, then selectively restore personal files — documents, photos — not applications or system settings.
For your router: most people never change the default admin credentials. That's a wide-open door. Access your router admin panel (usually 192.168.1.1 or 192.168.0.1), change the admin password, disable remote management if you don't use it, and check for firmware updates. CISA's router hardening guidance covers this in detail.
Also remove any apps you no longer use. An abandoned app with an unpatched vulnerability is a standing invitation. Fewer apps means a smaller attack surface.
The honest trade-off: Even after doing all of this, you cannot achieve zero risk. Sophisticated malware can survive factory resets by embedding in device firmware — a technique documented in threat actors like Fancy Bear and commercial spyware like Pegasus. If you're a high-value target, software-level defense has hard limits; hardware replacement is sometimes the only real answer. For most people, that level of threat is unlikely — but knowing the ceiling of what consumer-level security can and cannot do is more useful than false confidence.
- CISA – Malware and Botnets
- FTC – VPN Disclosure Practices
- CISA – Secure Your Router
- Have I Been Pwned