Google to confirm all Android devs to dam malware on Google Play

Google is introducing a brand new protection for Android referred to as ‘Developer Verification’ to block malware installations from sideloaded apps sourced from outdoors the official Google Play app retailer.

For apps on Google Play, there was already a requirement for publishers to offer a D-U-N-S (Knowledge Common Numbering System) quantity, launched on August 31, 2023.

Google says this has had a notable impact in decreasing malware on the platform. Nonetheless, the system didn’t apply to the huge developer ecosystem outdoors the app retailer.

“We’ve seen how malicious actors conceal behind anonymity to hurt customers by impersonating builders and utilizing their model picture to create convincing pretend apps,” reads Google’s announcement.

“The dimensions of this menace is critical: our latest evaluation discovered over 50 instances extra malware from internet-sideloaded sources than on apps obtainable by way of Google Play.”

Though the menace is extra prevalent outdoors Google Play, the developer verification requirement applies to each apps on Google Play and apps hosted on third-party app shops.

Beginning in 2026, all apps put in on licensed Android units should come from builders who’ve verified their identification with Google.

Early entry to the Developer Verification program will start this 12 months in October, and the system will open to all Android software builders in March 2026.

In September 2026, the identification verification requirement will change into obligatory for Brazil, Indonesia, Singapore, and Thailand, earlier than it rolls out globally in 2027.

The anticipated impact is to have sideloading, non-compliant apps blocked by the working system with a safety message on licensed units.

Licensed Android units are those who have handed Google’s Compatibility Check Suite (CTS) and are authorised to ship with Google Play Providers, Play Retailer, and Play Defend.

In follow, this encompasses all mainstream units from Samsung, Xiaomi, Motorola, OnePlus, Oppo, Vivo, and the Google Pixel line.

Non-certified units are these from Huawei, Amazon Fireplace tablets, and shady Chinese language TV bins or smartphones that use closely modified OS photos and questionable parts.

These units will not be topic to the brand new rule enforcement, and their customers will be capable to proceed sideloading APKs from unverified and nameless builders.

46% of environments had passwords cracked, practically doubling from 25% final 12 months.

Get the Picus Blue Report 2025 now for a complete have a look at extra findings on prevention, detection, and knowledge exfiltration traits.

Get the Blue Report 2025