malware adding to Google Contacts

Question

I found a contact that I don't recognize. Is there a way for an Android phone malware to add to my Google Contacts?

I generally only run Skype and YouTube on the phone. Occasionally I use the default browser.

Answer 1

An app must have permission to access your contacts in order to modify them. When you install an app, prior to Android 6, you have to agree to the permissions it requests in order to install. Android 6 and later you have to agree to permissions when you run the app. An app doesn't visibly have to do anything with your contacts to modify them; as long as it is running, it can work with whatever it has permission to access.

So, you might check the permissions for various apps you use and see if they have been granted access to contacts. You can do this through Settings > Apps > (each app).

Also, you might consider the browsers you use. If a browser has access to contacts, it might be possible (I don't know for sure) for javascript or some browser extension to write to contacts.

One more thing to be wary of: if you have installed a custom keyboard, it can be a source of compromising your system. For example, an untrustworthy keyboard could capture account names passwords and send them to some hidden third party.