Play Protect Archives

AppWizard

March 20, 2026

Google Adds 24-Hour Wait for Unverified App Sideloading to Reduce Malware and Scams

Google has introduced a new "advanced flow" for Android sideloading, which includes a mandatory 24-hour waiting period for users installing applications from unverified developers. This follows a developer verification mandate requiring all Android applications to be registered by verified developers to help identify malicious actors and reduce malware distribution. The new sideloading protocol aims to mitigate risks from cybercriminals who may deceive users into disabling Play Protect, Google's anti-malware feature. Over 50 app developers and marketplaces, including F-Droid and Brave, have expressed concerns about the registration requirements, arguing they could create barriers and raise privacy issues. Google has outlined a one-time process for sideloading apps, which includes enabling developer mode, confirming voluntary sideloading, restarting the device, waiting 24 hours, and using biometric authentication or a PIN to install apps. Google plans to introduce free "limited distribution accounts" for hobbyist developers and students to share apps with up to 20 devices without needing government-issued IDs or registration fees. This process will not apply to installations via the Android Debug Bridge (ADB) and is set to be available in August 2026, ahead of new developer verification requirements. This announcement comes as a new Android malware, Perseus, targets users in Turkey and Italy, with at least 17 distinct Android malware families identified in the past four months.

AppWizard

March 16, 2026

Advanced Protection Mode in Android 17 prevents apps from misusing Accessibility Services

Android 17 has introduced Advanced Protection Mode (AAPM) to enhance user security by preventing non-accessibility applications from using the Accessibility API, which has been exploited by malware. AAPM allows only verified accessibility tools to utilize the API and implements stricter security settings, including blocking installations from unknown sources, limiting USB data access, and mandating Google Play Protect scans. Applications must declare themselves as accessibility tools with the attribute isAccessibilityTool="true" to use the Accessibility Services API. Additionally, Android 17 features a new contacts picker that allows applications to request access to specific contact fields instead of the entire address book, enhancing user privacy.

AppWizard

March 16, 2026

Android 17 Blocks Non-Accessibility Apps from Accessibility API to Prevent Malware Abuse

Google is piloting a security enhancement in its Android Advanced Protection Mode (AAPM) that restricts certain applications from using the accessibility services API. This update is part of Android 17 Beta 2. AAPM, introduced in Android 16, enhances device security by blocking app installations from unknown sources, restricting USB data signaling, and mandating Google Play Protect scanning. Developers can integrate with AAPM through the AdvancedProtectionManager API to adapt their apps based on the security mode's status. The new restriction prevents non-accessibility apps from accessing the accessibility services API, allowing only verified accessibility tools like screen readers and voice-based input tools. Non-accessibility apps, including antivirus software and password managers, will have their access revoked when AAPM is activated, and users cannot grant permissions to these apps unless AAPM is disabled. Additionally, Android 17 introduces a new contacts picker feature that allows developers to specify which fields to access from a user's contact list, providing more granular control over data access.

AppWizard

March 13, 2026

F-Droid says Google’s Android developer verification plan is an ‘existential’ threat to alternative app stores

Developers distributing apps outside of Google's Play Store will be required to register with Google in certain countries starting in September, with plans for global expansion by 2027. This policy aims to enhance security by removing anonymity from developers but comes with a registration fee and the need for government identification. F-Droid, an open-source app repository, has raised concerns that this policy could threaten its existence by mandating a single signature for all apps. F-Droid initiated a public campaign against these changes, garnering support from various organizations. Despite some interest from regulators, progress is slow, and there are fears that Google's verification program may be implemented before any regulatory action occurs. F-Droid encourages developers to avoid signing up for the early access program and has launched a petition to voice concerns.

AppWizard

March 11, 2026

New BeatBanker Android malware poses as Starlink app to hijack devices

A newly identified Android malware called BeatBanker disguises itself as a Starlink application on fake Google Play Store websites. It functions as a banking trojan and includes Monero mining capabilities, allowing it to steal credentials and manipulate cryptocurrency transactions. Researchers at Kaspersky traced BeatBanker to campaigns targeting users in Brazil. The latest version uses the BTMOB RAT for remote access, enabling keylogging, screen recording, camera access, GPS tracking, and credential capture. BeatBanker is distributed as an APK file that decrypts and loads hidden code into memory, conducting environment checks before activation. It presents a fake Play Store update screen to trick users into granting permissions for additional payloads. To avoid detection, it delays malicious operations and plays a nearly inaudible MP3 file to maintain persistent activity. The malware uses a modified version of the XMRig miner to mine Monero on Android devices, connecting to mining pools through encrypted TLS connections. It can start or stop mining based on device conditions and uses Firebase Cloud Messaging to relay device information to its command-and-control server. Currently, BeatBanker infections have only been observed in Brazil, but there are concerns about its potential spread. Users are advised to avoid side-loading APKs from untrusted sources and to review app permissions regularly.

AppWizard

March 4, 2026

Google Announces Registered App Stores For Android

Google is launching a Registered App Stores program for Android, allowing third-party app stores to officially register if they meet specific quality and safety criteria. This program aims to provide a better installation experience for users and will be rolled out in a major Android release later this year, initially targeting markets outside the US. Registration is optional, and stores can continue using the existing sideloading process. Alongside this, Google is unbundling its fee structure, reducing service fees for developers to between 15% and 20%, with an additional 5% fee for using Google Play billing in certain regions. The rollout of the new billing structure is expected by the end of June in the US, UK, and Europe, with global completion by September 30, 2027. The initiative is part of a broader settlement with Epic Games and reflects ongoing legal pressures for greater competition in app distribution.

Tech Optimizer

February 22, 2026

Researchers Discover First Android Malware Using Generative AI for Persistence

Security researchers have identified a new Android Trojan named PromptSpy that uses generative AI technology to enhance its persistence on compromised devices. Discovered by ESET researchers, PromptSpy leverages Google's Gemini AI model to analyze infected device screens and generate tailored instructions for embedding itself within recent apps lists. It includes a Virtual Network Computing (VNC) module that allows attackers full remote control over the device, enabling activities such as viewing the screen, performing actions remotely, capturing lock screen data, blocking uninstallation attempts, gathering device information, taking screenshots, and recording screen activity as video. The malware communicates with command-and-control servers using AES encryption and exploits Android Accessibility Services, making it difficult to remove. PromptSpy is distributed through a dedicated website and is financially motivated, adapting to various Android interfaces and operating system versions. ESET's analysis indicates that the malware is regionally targeted, with a focus on Argentina, and may have been developed in a Chinese-speaking environment. The same threat actor is believed to be responsible for both VNCSpy and PromptSpy.

AppWizard

February 22, 2026

Google Blocks Millions of Risky Android Apps: Biggest Play Store Cleanup Yet

Google blocked approximately 1.75 million dangerous or policy-violating apps from reaching users in 2025 and shut down over 80,000 developer accounts associated with fraud, malware, and repeated policy violations. Play Protect identified millions of risky apps installed from external sources, and it scans apps in real-time, even after installation. Key reasons for app rejections include malware behavior, financial fraud, misuse of permissions, and deceptive advertisements. The crackdown results in safer app downloads, reduced risk of data theft, improved privacy enforcement, and lower exposure to counterfeit applications.

AppWizard

February 20, 2026

Google says its AI systems helped deter Play Store malware in 2025

Google reported a decrease in malicious apps targeting its Google Play platform, preventing 1.75 million policy-violating apps from being published in 2025, down from 2.36 million in 2024 and 2.28 million in 2023. The company banned over 80,000 developer accounts in 2025 for attempting to publish harmful apps, a decrease from 158,000 in 2024 and 333,000 in 2023. Google conducts over 10,000 safety checks on every app before publication and has integrated generative AI models into the app review process. The company prevented more than 255,000 apps from gaining excessive access to sensitive user information, down from 1.3 million in 2024, and blocked 160 million spam ratings and reviews. Additionally, Google Play Protect identified over 27 million new malicious apps, an increase from 13 million in 2024 and five million in 2023.

AppWizard

February 20, 2026

Google rejected nearly two million Android apps and blocked more than 80,000 developer accounts from Google Play in 2025

Google blocked 1.75 million applications from the Play Store in 2025 for policy violations and took action against over 80,000 developer accounts identified as “bad actors.” Additionally, 255,000 apps were restricted from accessing sensitive user data. The company implemented measures such as developer verification, mandatory pre-review checks, and stringent testing requirements to enhance security. Google’s Play Protect system scanned 350 billion apps daily and flagged 27 million malicious applications outside the Play Store. The integration of Generative AI models into the app review process improved the identification of malicious patterns and expedited application reviews.