My wife somehow clicked on a malicious website on her phone and it's absolutely blowing up with spam and malicious links. I had virus protection on it and she must have kept clicking links until they took over her phone.
I'm hoping a factory reset will cure it. Unfortunately, she doesn't remember her passwords and decided to change her recovery email address to one on the compromised phone.