I accidentally opened an adult website on my Android phone after tapping a link in a Google search. The phone has a March 2025 security patch, and Samsung Internet is fully updated. I later read an old website review claiming that someone had encountered a Trojan after visiting it, although the review was about 13 years old.
After closing the tab, I noticed some lag while opening my gallery. Later that day, I also saw that my Instagram account was following an unfamiliar account, even though I do not remember following it. I scanned the phone with Malwarebytes, Bitdefender, and Samsung's built-in security tools, but none found anything. I also checked for newly installed apps and unfamiliar files without finding anything.
Could simply visiting the page have caused a drive-by download or other infection, or are the lag and unexpected Instagram follow more likely to be coincidences?
3 Answers
A normal website cannot usually install an Android app silently. Even if a file was downloaded, it would generally need to be opened and granted permission before it could do anything significant. Drive-by exploits technically exist, but a fully functional zero-click exploit is extremely rare and would normally be reserved for carefully selected targets, not random visitors. Keep the phone and browser updated, avoid installing files from the page, and you should be fine.
There is no absolute guarantee with any scanner, but in this situation a hidden infection is very unlikely. The lack of a new app, suspicious file, permission prompt, or continuing unusual behavior is reassuring.
Run a scan with a reputable Android security app, which you have already done. Also check your installed apps, downloads, accessibility services, device administrator settings, and your Instagram login and activity history. If those look normal and the phone is receiving security updates, there is no clear evidence that it was hacked. The safest practical step is simply to keep updating the device and avoid opening or installing unexpected downloads.
If you only opened the page and did not install or run an APK, the risk is very low. Updated Android browsers have strong protections, and scans from reputable security apps plus Samsung’s own check finding nothing is reassuring. A decades-old report is not a good indication of what the site can do today. The lag and Instagram follow are more likely unrelated coincidences, though you can review Instagram’s account activity to see when the follow happened.
Thanks, that helps. I’ll check the account activity as well.
Could something still be hidden even if antivirus apps did not detect it?