Loading story…
Google detailed a new 24-hour waiting period for Android users who want to install apps from unverified developers, part of a broader sideloading policy change tied to developer identity verification. The new advanced flow requires users to enable Developer Mode and then wait before bypassing app verification, a design Google says is intended to disrupt social engineering scams that pressure victims into installing malicious APKs immediately. Google framed the delay as a safeguard for users whose phones hold sensitive personal and financial data, while still preserving a path for experienced users to take what it calls an informed risk.
Google introduced the exception after backlash to its earlier plan to require verified developer accounts for apps on certified Android devices, including criticism from power users and civil society groups that objected to the identity verification requirement and associated fee. Reporting indicates the bypass can be enabled through a one-time process, and users who want unrestricted sideloading can select an indefinite option rather than waiting each time. The change does not eliminate Google's verification regime, but it creates a compromise that keeps sideloading available while adding friction specifically aimed at malware delivery campaigns that rely on urgency and coercion.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Google's expanded developer verification program is expected to move to broader enforcement in 2027, following the phased rollout described in earlier announcements. This marks the longer-term tightening of identity and trust requirements for Android app distribution.
Google said broader developer identity verification requirements for Play developers are set to begin in September 2026. Limited student and hobbyist accounts will remain available for small-scale distribution to up to 20 devices without the standard fee and full verification.
Google said the new advanced flow for sideloading unverified apps and related options for unverified developer distribution would roll out via Google Play Services in August on Android devices. The company also said these options would be available before stricter developer verification requirements take effect.
Google announced that Android users would still be able to install apps from unverified developers, but only through a high-friction process designed to reduce malware and social-engineering abuse. The process includes enabling developer-related settings, confirming the user is not being coerced, rebooting or reauthenticating, and waiting 24 hours before installing an unverified APK.
Google started rolling out expanded developer identity verification in the Play Console in phases, including collection and display of developer information and business verification measures. The rollout was described as continuing through 2026, with broader enforcement later expected in 2027.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcebleepingcomputer.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcehowtogeek.com
Open sourcearstechnica.com
Open sourcego.theregister.com
Open sourceopennet.me
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has announced a new policy requiring all Android apps installed outside the Google Play Store to undergo developer verification, aiming to curb the rise of malware and scam campaigns exploiting sideloading. The company cited increasingly aggressive online threats and the use of social engineering tactics that prompt users to bypass existing security warnings, leading to the installation of malicious applications. Under the new system, unverified apps will be blocked from installation on Google-certified devices, with the goal of making it harder for threat actors to distribute harmful software. In response to backlash from users and developers concerned about the impact on Android's openness, Google has stated that it will provide an exemption mechanism for "experienced users" or power users, though the specifics of this bypass have not yet been finalized. The move represents a balancing act between enhancing platform security and maintaining the flexibility that has traditionally set Android apart. Google has previously faced criticism for similar restrictions and appears to be adjusting its approach to address both security and user autonomy concerns.
Jun 29, 2026
Google is preparing an Android change that adds an **“Accountability Layer”** to sideloaded (third‑party) apps, introducing a higher-friction installation flow intended to make users acknowledge the risks rather than banning sideloading outright. Google’s Matthew Forsythe said advanced users will still be able to proceed via an *Install without verifying* option, while Android’s developer verification requirements are being expanded, including a new account type aimed at students and hobbyists that can distribute apps with limited reach without completing full verification. The move aligns with continued growth in Android malware distributed via sideloaded APKs, which threat researchers report remains a primary infection vector despite protections like **Google Play Protect**. Kaspersky reported preliminary 2025 data showing Android threat detections rising by nearly half, with Q3 detections up **38%** versus Q2 and sharp growth in **trojan banker** activity; attackers commonly deliver malicious APKs through messaging apps (often using deceptive filenames like `party_pics.jpg.apk`) and then propagate further via victims’ contact lists, with search-engine spam and email lures also used to drive installs outside official app stores.
Jun 29, 2026
Google has set **September 30, 2026** as the first enforcement date for new Android developer verification rules that tie app distribution to verified publisher identities. The initial rollout will apply to certified Android devices in **Brazil, Indonesia, Singapore, and Thailand**, where developers distributing apps through participating stores must complete identity checks through the Android Developer Console by submitting personal or organizational details such as legal identity, contact information, and in some cases a **DUNS** number. Google said the move is intended to make anonymous publication of malicious apps harder and improve accountability across the Android app ecosystem. The controls will extend beyond Google Play to participating marketplaces including **HONOR App Market, OPPO App Market, Samsung Galaxy Store, Palm Store, vivo V-Appstore, and Xiaomi GetApps**, with broader expansion planned in **2027**. Google is also adding APIs and a system service for app registration, verification checks, and bulk management through CI/CD workflows, alongside operational safeguards for APK testing and account management. After enforcement begins, only apps registered by verified developers will be allowed to install or update on certified Android devices in affected markets, though sideloading will remain possible through **Android Debug Bridge** or a new advanced installation flow for unverified developers.
Jul 12, 2026