Google Play Protect Archives

BetaBeacon

June 19, 2026

This app can translate your favorite games into any language, but there’s a big catch

- Google Play Protect blocks the app's installation due to sensitive permissions, such as recording the screen and utilizing the "display over other apps" permission. - The developer used generative AI to assist with the app's development, but claims to heavily review the code and make/validate all architectural decisions to ensure security.

BetaBeacon

June 19, 2026

PlayTranslate brings realtime game translation to Android

PlayTranslate is an open-source Android app that provides realtime overlay translation for games, supporting 23 in-game languages translated into 59 different languages. Users may need to temporarily pause Google Play Protect to install the app due to screen-record and display-over-apps permissions. It also offers offline translations, text-to-speech functionality, flashcard features, and multi-screen translation options.

AppWizard

June 19, 2026

Rokarolla trojan uses screen overlays to hijack Android financial apps

A new banking trojan for Android, named Rokarolla, targets 217 applications, including banking and cryptocurrency platforms, to steal credentials and sensitive financial data. It operates via a command and control (C2) server and bypasses the Google Play Store by using phishing websites that mimic legitimate download portals. Users are tricked into downloading a dropper that installs the malware, which disguises itself as the Google Play Protect security tool to gain access to Android Accessibility Services. Rokarolla employs dynamic screen overlays to capture user input in targeted financial applications and can also impersonate the device's lock screen. Additionally, it uses a pseudo-VNC system to intermittently capture screenshots for data extraction and can modify clipboard contents to manipulate cryptocurrency transactions by replacing copied addresses with those controlled by attackers.

AppWizard

June 17, 2026

New Rokarolla Android Trojan Targets 217 Banking and Crypto Apps

Zimperium’s zLabs researchers have analyzed a newly identified Android banking trojan named Rokarolla, which targets 217 distinct banking and cryptocurrency applications. It is distributed through malicious websites that impersonate popular platforms like TikTok and Google Chrome, with one identified distribution point being hxxps://infocontablidades[.]it[.]com/. The malware uses a dropper disguised as Google Play Protect to install a second-stage payload and gain Accessibility Services access, allowing it to simulate user interactions and manipulate on-screen elements. Rokarolla downloads counterfeit HTML login pages for targeted applications and overlays them to capture user credentials, including sensitive card information. It can also deploy a fraudulent PIN entry screen, read and send SMS messages, intercept one-time codes from banks, and block incoming calls. The malware rewrites the clipboard, operates a keylogger and screen content logger, and scrapes WhatsApp contact data. It captures screenshots without alerting users and has a resilient command-and-control infrastructure with multiple fallback domains. No product flaws are exploited, and defenses against it include installing apps only from Google Play and being cautious with Accessibility Services. Zimperium’s Mobile Threat Defense and zDefend products can detect Rokarolla, and a list of indicators of compromise is available on their GitHub repository.

AppWizard

June 16, 2026

New Rokarolla Android malware targets 217 banking, crypto apps

A new Android banking trojan named Rokarolla targets 217 banking and cryptocurrency applications and features 137 commands for malicious activities. It is distributed via deceptive websites posing as legitimate application sources and impersonates Google Play Protect to lure users into installing infected apps. Once installed, it seeks Accessibility service permissions and access to notifications, SMS, and calls. Rokarolla communicates with a command-and-control server, sending device profiles to generate unique identifiers for victims. Its primary goal is to steal financial information by using deceptive login overlays to capture sensitive data and maintain control over the device. The malware employs evasion tactics such as disabling Google Play Protect, hiding its icon, silencing notifications, and keeping the screen awake. It can steal SMS messages, extract contacts, capture keystrokes, record screen content, manipulate clipboard contents, block calls, and take screenshots. Zimperium confirms that Rokarolla is not found on Google Play, and users are advised to avoid downloading APK files from untrusted sources and to be cautious with Accessibility permissions.

AppWizard

June 16, 2026

New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds

Security researchers at Zimperium's zLabs have identified a new Android banking trojan named Rokarolla, which can target 217 banking and cryptocurrency applications and execute 137 remote commands. The malware spreads through deceptive websites that impersonate popular apps, installing a dropper that mimics Google Play Protect to gain Accessibility access. It uses overlay techniques to capture sensitive information by displaying counterfeit login pages and can intercept SMS messages, including one-time codes from banks. Rokarolla also features a keylogger, screen logger, and can rewrite clipboard contents to divert cryptocurrency payments. It employs advanced methods for discreet data capture and has multiple fallback command-and-control domains, making it resilient against takedowns. There is no patch available for this malware, and users are advised to install apps only from Google Play and remain cautious of unexpected Accessibility requests. Zimperium's products can detect this malware, and indicators of compromise are available on their GitHub repository.

AppWizard

June 12, 2026

Android users need to uninstall these apps ASAP as they are a security risk

Google will soon notify Android users when an app they installed has lost developer support. Currently, users only receive alerts from Play Protect for significant security threats or potentially harmful apps. The only way to discover if an app has been delisted is through external sources or by trying to install it on a new device. Recent findings in the Play Store indicate that Google is preparing to inform users when apps have been removed from the Play Store and will no longer receive updates. Abandoned apps pose significant security risks, as they may contain vulnerabilities that can be exploited by malicious actors. Google's new notifications aim to encourage users to uninstall unsupported apps to protect their personal data.

AppWizard

May 27, 2026

Google could soon flag the dead Android apps hiding on your phone

Google is developing a new notification system for the Play Store that will inform users when an installed app has been removed, providing tailored messages based on the number of affected apps. Currently, Google Play Protect only alerts users about harmful apps but does not notify them about apps that are voluntarily removed or delisted for policy violations. The new system aims to address this gap by notifying users that apps will no longer receive updates, which is a concern for security and functionality. There is no specific timeline for the release of this feature, and the findings are based on code snippets that may not all make it to the final version.

AppWizard

May 26, 2026

Google might soon start warning you about dead Android apps on your phone

Google is developing a feature to alert users when an app installed on their device has been removed from the Play Store. Currently, users do not receive notifications about apps that have been delisted for non-security reasons. Recent findings from an APK teardown of the Google Play Store v51.4.19 indicate that users may soon receive notifications regarding inactive or delisted apps, focusing on keeping them informed about updates. This update aims to help users declutter their devices by notifying them of apps that will no longer receive updates. The timeline for the rollout of these notifications is not yet clear.

AppWizard

May 26, 2026

Google Play Store could soon warn you about dead Android apps on your phone

Google is working on enhancing its notification system for app removals from the Play Store. Currently, users do not receive alerts when an app is removed for reasons other than serious security violations. The latest version of the Google Play Store (v51.4.19) contains code indicating a new feature that will notify users when an installed app has been removed, informing them that the app will no longer receive updates. Notifications will vary based on the number of affected apps, providing clear communication to users. These features are still in development and may not be guaranteed for public release.