You should backtrack it to the source. Start with your sister's phone. Is it doing anything else odd like a glitching screen or an app she didn't install?

Did it go to anyone else?

Get a tech to look at it in depth. If it's a virus, everyone makes mistakes. Did the virus dev leave any clues?

How might she have gotten it in the first place? I'm worried she's making friends with bad people. Really bad people.