I'm using a Nothing Phone (2a), and a 23 MB PDF called "SaaS Playbook" has appeared in my Downloads folder twice—once recently and once about two months ago. Both times, the phone was unlocked, but I wasn't intentionally browsing or reading anything related to SaaS. I deleted the file after the first occurrence and ran malware scans, antivirus checks, and a full security scan, but nothing suspicious was found. All of my installed apps came from Google Play. What could be causing this, and how can I identify the app or action responsible?
3 Answers
Look through recent notifications and the download history in every browser you use. If the file appears again, note the exact time and compare it with your browser and app activity. You can also review which apps have permission to access files and remove permissions from anything that doesn’t need them.
Check your browsers for open tabs, saved pages, or downloads that may have been triggered accidentally. A link in an email, notification, or webpage can start a download without you deliberately searching for that subject.
A PDF appearing in Downloads doesn’t automatically mean the phone is infected. Since it’s the exact same file, check its file details and your browser’s download history. That may show whether Chrome or another app created it and when the download started. Google Play Protect and clean security scans are reassuring, but finding the source is more useful than repeatedly deleting the file.
The fact that it happened months apart makes an accidental link or browser-related download more likely than an active infection, especially if all scans remain clean.