The play store is filled with open source software. But Android is another prime target for bad actors, I mean it’s the second largest smartphone operating system in the world. More users = more people to exploit. But… that makes us all kind of backed into a corner. I mean you only have a few options for alternative smartphones that have unlocked bootloaders, and come with a mobile linux distro(that isn’t android). It’s the way of the world, sadly. I think more than anything I’m trying to be like a jehovas witness, wanting to encourage people to take control of their digital presence and interaction. I think I’m mostly more comfortable with OSS because I am technically inclined, and I can skim thru the source code before I use it. With Apple? Microsoft? I don’t have that control. I have to blindly trust a company that views me as a financial asset.

There is one good phone for linux called the PinePhone

The password reset prompts are just to fatigue you… once fatigued you may then click on a similar looking multi-factor login verification link. Not sure if Apple sends those, or if you have to enter a number/code into the page. That attack would be the attacker using stolen username/password to login. If multi-factor is on, they may send you a link or a code to enter to complete the login. It’s that bit the attacker needs.

This article is interesting:

How To Detect A Keylogger On An iPhone
https://www.certosoftware.com/insights/how-to-detect-a-keylogger-on-an-iphone

I am NOT promoting certosoftware. The author makes practical suggestions:

Check for custom keyboards
On your iPhone, go to Settings > General > Keyboard > Keyboards. For most devices, you should see two keyboards called something like:

English (US).
Emoji.

If you see any other keyboards listed that you don’t recognize, it’s possible that it could be a keylogger.

and more.