Persistent malware despite factory resets

Question

I'd love your thoughts on this. Several months ago I mistakenly clicked a popup on a website, and since then have been getting intermittant popups says "your sim card is infected...etc" and it tries to direct me to the play store to install some sketchy "antivirus" app (which I have never downloaded).

The issue is, I've done multiple factory resets, but after a few days I get the popup again. I've tried 10 antivirus apps from the play store, google chrome's malware detector, but everything comes up clean. Most recently, I used TWRP to completely wipe all data from my phone (wiped Dalvik, system, storage, data, cache, everybox I could check), and before reinstalling Oreo 8.1 I wiped all my data being synced by Google. Still, a few days later, I get the popup, without visiting sketchy websites or downloading non-standard apps in the interim.

I figure there is either something that is being synced to my phone from my Google account (I use google Fi and it requires I use my google login), or there is some niche in my phone that is not getting wiped. The only other thing I can think of is that these are just regular popups, and not part of malware, but that seems unlikely since I didn't get them before I clicked the banner that one time.

Any suggestions on how to get rid of this thing? Thanks!

Answer 1

You can try identifying the app the next time it brings up that popup by checking the foreground activity using dumpsys:
adb shell dumpsys activity activities|grep mFocusedActivity
OR
If it's just a window without an activity use adb shell dumpsys window windows and search for apps whose windows have isReadyForDisplay()=true, this may help you be able to identify exactly what app is responsible for the popup so you can disable or remove it

Answer 2

Thanks for the input everyone. It wasn't an app. That's been the difficulty for people with this issue, is that it isn't some app. At least as far as I can tell.

I got my cellular provide to supply a new SIM card (which they did for free). And while I've cleared my google synced content and used TWRP to blank and reinstalled my OS several times before, I basically did it back to back to back...and probably again.

No problems since.