There are a few questions to address here:
Firstly, the real file type. You need to check the file extension but that doesn't necessarily indicate the real file type, you need to check the file type indicator - the "magic bytes", there are libraries for many development platforms to do this for you and you can read more about it here.
On virus scanning, you can either run a scanning engine on a server and submit files to that or you can use an API like Virus Total. There are a few issues to consider with sending the file out to an API.
Where is the API located? Is it in the same country as you, there may be data law restrictions on sending the file out to a scan engine in another country if those images may contain personal information (like faces, names, email addresses etc)
Files uploaded to certain scan engines may be available to other people, consider if this presents any problems for you or your users. You can mitigate this by running your own 'on-prem' system but this will require infrastructure to run and possibly incur additional licensing.
The second consideration is when do you scan? If a user uploads an image, do you scan on demand as soon as they attempt an upload? This will cause a delay in the upload but prevent any viruses getting into your file storage. The alternative is to allow uploads without scanning first and have an agent that runs, scanning files, removing problem files as it goes. It depends on the requirements you have.