Loading story…
Google reported that its 2025 enforcement and review efforts blocked over 1.75 million policy-violating app submissions from being published on Google Play and resulted in bans of more than 80,000 developer accounts tied to harmful behavior. Google attributed these outcomes to expanded AI-powered, multi-layered defenses, including developer verification, mandatory pre-review checks, and testing requirements intended to raise the barrier for malicious or non-compliant apps and reduce user harm such as malware, financial fraud, hidden subscriptions, and privacy-invasive behavior.
Google also said it prevented over 255,000 apps from obtaining excessive access to sensitive user data and that Google Play runs 10,000+ safety checks as part of its protections, with detection strengthened by integrating newer generative AI models to help reviewers identify evolving malicious patterns. Additional ecosystem integrity measures cited include blocking 160 million suspicious/inauthentic ratings and identifying large volumes of malicious sideloaded apps via Play Protect, which Google said scans hundreds of billions of apps daily and expanded “enhanced fraud protection” coverage broadly across Android devices, blocking large numbers of risky installation attempts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
On February 19, 2026, Google publicly released its annual review summarizing 2025 security actions across Google Play and Android, including AI-driven app review, anti-fraud measures, and Play Protect statistics. Multiple outlets then reported the same findings from the published review.
Google said Android 16 introduced built-in mitigations against tapjacking and hidden-window attacks that can trigger fraudulent taps or expose sensitive data. The protections were highlighted as part of the platform's 2025 security improvements.
During 2025, Google introduced in-call scam protections designed to stop social-engineering attempts that try to convince users to disable Play Protect while on phone calls. The feature was presented as a defense against fraud and sideloading-based attacks.
In 2025, Google expanded Play Protect's enhanced fraud protection to 185 markets covering 2.8 billion Android devices. The company said the feature blocked 266 million installation attempts involving 872,000 unique risky apps requesting sensitive permissions.
Across 2025, Google Play Protect scanned more than 350 billion apps daily and identified over 27 million new malicious apps, primarily from outside Google Play. Google said this reflected the growing importance of defending against sideloaded and off-store threats.
In 2025, Google reported blocking more than 255,000 apps from obtaining excessive access to sensitive user data and stopping 160 million spam or manipulated ratings and reviews, including mitigation of review bombing. These actions were part of broader privacy and anti-abuse enforcement on Google Play.
During 2025, Google said it prevented more than 1.75 million policy-violating apps from being published on Google Play and banned over 80,000 developer accounts associated with harmful activity. Google attributed the results to its layered review and enforcement systems.
Throughout 2025, Google expanded app ecosystem protections including developer verification, mandatory pre-review checks, more than 10,000 safety checks per app, generative-AI-assisted app review, and broader post-publication monitoring. It also rolled out Play Integrity API enhancements, device recall beta, and other developer-facing security tools to harden the ecosystem.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcetechrepublic.com
Open sourcehelpnetsecurity.com
Open sourcesecurity.googleblog.com
Open sourcebleepingcomputer.com
Open sourcetechcrunch.com
Open sourcesecurity.googleblog.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has announced a new policy requiring all Android apps installed outside the Google Play Store to undergo developer verification, aiming to curb the rise of malware and scam campaigns exploiting sideloading. The company cited increasingly aggressive online threats and the use of social engineering tactics that prompt users to bypass existing security warnings, leading to the installation of malicious applications. Under the new system, unverified apps will be blocked from installation on Google-certified devices, with the goal of making it harder for threat actors to distribute harmful software. In response to backlash from users and developers concerned about the impact on Android's openness, Google has stated that it will provide an exemption mechanism for "experienced users" or power users, though the specifics of this bypass have not yet been finalized. The move represents a balancing act between enhancing platform security and maintaining the flexibility that has traditionally set Android apart. Google has previously faced criticism for similar restrictions and appears to be adjusting its approach to address both security and user autonomy concerns.
Jun 29, 2026
Google has set **September 30, 2026** as the first enforcement date for new Android developer verification rules that tie app distribution to verified publisher identities. The initial rollout will apply to certified Android devices in **Brazil, Indonesia, Singapore, and Thailand**, where developers distributing apps through participating stores must complete identity checks through the Android Developer Console by submitting personal or organizational details such as legal identity, contact information, and in some cases a **DUNS** number. Google said the move is intended to make anonymous publication of malicious apps harder and improve accountability across the Android app ecosystem. The controls will extend beyond Google Play to participating marketplaces including **HONOR App Market, OPPO App Market, Samsung Galaxy Store, Palm Store, vivo V-Appstore, and Xiaomi GetApps**, with broader expansion planned in **2027**. Google is also adding APIs and a system service for app registration, verification checks, and bulk management through CI/CD workflows, alongside operational safeguards for APK testing and account management. After enforcement begins, only apps registered by verified developers will be allowed to install or update on certified Android devices in affected markets, though sideloading will remain possible through **Android Debug Bridge** or a new advanced installation flow for unverified developers.
Jul 12, 2026
Google is preparing an Android change that adds an **“Accountability Layer”** to sideloaded (third‑party) apps, introducing a higher-friction installation flow intended to make users acknowledge the risks rather than banning sideloading outright. Google’s Matthew Forsythe said advanced users will still be able to proceed via an *Install without verifying* option, while Android’s developer verification requirements are being expanded, including a new account type aimed at students and hobbyists that can distribute apps with limited reach without completing full verification. The move aligns with continued growth in Android malware distributed via sideloaded APKs, which threat researchers report remains a primary infection vector despite protections like **Google Play Protect**. Kaspersky reported preliminary 2025 data showing Android threat detections rising by nearly half, with Q3 detections up **38%** versus Q2 and sharp growth in **trojan banker** activity; attackers commonly deliver malicious APKs through messaging apps (often using deceptive filenames like `party_pics.jpg.apk`) and then propagate further via victims’ contact lists, with search-engine spam and email lures also used to drive installs outside official app stores.
Jun 29, 2026