With many countries trying to establish their own smart grids, smart meters are massively deployed throughout the world. Although smart meters are manufactured with low tamper-resistant components, malicious users with just a moderate level of computer knowledge are able to launch cyber attacks. By manipulating electricity consumption readings to smaller values, malicious users can steal electricity from utility companies. To reduce the losses incurred by electricity theft, utility companies must provide preventative and detective methods to identify fraudulent behaviors. Our goal is to identify all malicious users in a neighborhood area network within the shortest detection time. To achieve this goal, we propose Group Testing based Heuristic Inspection (GTHI) algorithm, which can estimate the ratio of malicious users on-line, mainly by collecting the information that how many malicious users have been identified during the inspection process. Based upon the ratio of malicious users, the GTHI algorithm adaptively adjusts inspection strategies between an individual inspection strategy and a group testing strategy. This helps shorten the detection time. Furthermore, when applying the group testing strategy, the GTHI algorithm also determines the group size of users to be probed in line with the estimated malicious user ratio. Experiment results show that compared to existing methods, the GTHI algorithm has advantages of conducting fewer inspection steps or being more practical.