Match sideload, jailbreak/root, data-spike, and overlay scareware tickets to FIRST software actions; leave battery-swap and raise-cap unused.
Match mobile security triage actions to each symptom. Leave battery-swap-first and raise-the-cap unused.
CompTIA mobile security symptoms: unofficial stores, root/jailbreak, data abuse, and overlay scareware — software FIRST, not hardware shopping.
Still on the bench
Remove sideloaded/unofficial store apps; re-enable Play Protect / App Store only — Unofficial APKs and sideload stores are the classic mobile malware path.
Isolate, document, then wipe / restore to stock (remove jailbreak/root) — Root/jailbreak breaks the trust model; corporate devices usually wipe to stock.
Sort cellular data by app; revoke the unexpected top talker — High usage is a symptom — identify the app before you raise the carrier cap.
Revoke overlay / accessibility abuse; uninstall scareware; scan — Home-screen ads and fake AV overlays are compromise symptoms, not 'bad websites.'
Replace the battery because the phone feels warm — Warmth from adware/CPU abuse is not a FIRST hardware FRU.
Raise the cellular data cap and close the ticket — Paying for the bleed does not remove the malicious app.