Short answer, for Android, only download apps from the playstore, and totally reset (factory reset) your phone every few months. In between, limit the number of apps to the bare minimum and keeping checking for apps that you didn't download. Unfortunately, there are a number of Android specific malware apps at the moment that do automatically redownload themselves, and there are more than a few apps that are ok, but have been caught downloading other malware.
The longer answer might include buying a phone with a more secure operating system.
You can put things like BitDefender on your phone to protect you from malicious ads and links. But that won't solve a bunch of things, though I think it helps.
The memory sandboxing that modern phones have basically prevents "spyware catchers" from doing anything other than adding malware to your phone. Don't go downloading them.
All the best,
Peter