1) Why device hygiene matters
If your phone/laptop is infected, attackers can read messages, steal files, and bypass 2FA prompts.

2) Core practices
Updates on: auto-update OS, browsers, and messaging apps.
Official stores only; never sideload random APKs.
Permissions sanity: camera/mic/location only when needed.
Antivirus on Android/Windows; enable Google Play Protect.
Backups: 3-2-1 rule (3 copies, 2 mediums, 1 offsite).
Screen lock + disk encryption (BitLocker/FileVault; Android/iOS default).
Separate profiles (work vs personal) if possible.

3) Safe messaging defaults
Signal/WhatsApp for E2EE chat; confirm safety numbers for sensitive contacts.
View-once for IDs/passports; avoid forwarding sensitive files to groups.
Turn off auto-download of media in high-risk groups.
Beware attachments: HTML, EXE, macro-Office = high risk.

4) Phishing inside chat apps
Admin impersonation asking for 6-digit codes.
“Join this meeting” links to credential-harvesting sites.
QR code scams that bind your session to attacker’s device.

5) If you suspect malware
Airplane mode → then power off if needed.
Remove unknown apps; check Accessibility and Device Admin lists.
Scan with reputable AV; update and rescan.
Rotate passwords from a clean device; revoke sessions in accounts.
Restore from backup if infection persists.

6) Team procedures
App allowlist for work devices; block risky APKs.
Shared vault (e.g., Bitwarden org) for passwords + 2FA policies.
Quarterly tabletop: practice responding to malware/phishing.
Spare device ready for emergencies (preconfigured with essential apps).

7) Reporting & help
Platform in-app reports for spam/malware links.
Telco/ISP if you suspect SIM abuse or network issues.
Org security focal for internal incident handling.
Law enforcement where appropriate.

8) Awareness snippets
Group notice: “Turn off auto-download of media in large groups to avoid drive-by malware.”
Tip card: “Install apps only from official stores; random APKs steal codes.”

9) Minimal policy controls
Enforce device updates and screen locks.
Centralize endpoint protection for staff devices.
Maintain a clean-device borrowing pool for urgent work.