Google to confirm all Android devs to dam malware on Google Play

Google is introducing a brand new protection for Android referred to as ‘Developer Verification’ to block malware installations from sideloaded apps sourced from exterior the official Google Play app retailer.

For apps on Google Play, there was already a requirement for publishers to supply a D-U-N-S (Information Common Numbering System) quantity, launched on August 31, 2023.

Google says this has had a notable impact in lowering malware on the platform. Nevertheless, the system didn’t apply to the huge developer ecosystem exterior the app retailer.

“We’ve seen how malicious actors conceal behind anonymity to hurt customers by impersonating builders and utilizing their model picture to create convincing faux apps,” reads Google’s announcement.

“The dimensions of this risk is critical: our current evaluation discovered over 50 occasions extra malware from internet-sideloaded sources than on apps accessible by means of Google Play.”

Though the risk is extra prevalent exterior Google Play, the developer verification requirement applies to each apps on Google Play and apps hosted on third-party app shops.

Beginning in 2026, all apps put in on licensed Android gadgets should come from builders who’ve verified their id with Google.

Early entry to the Developer Verification program will start this yr in October, and the system will open to all Android utility builders in March 2026.

In September 2026, the id verification requirement will grow to be obligatory for Brazil, Indonesia, Singapore, and Thailand, earlier than it rolls out globally in 2027.

The anticipated impact is to have sideloading, non-compliant apps blocked by the working system with a safety message on licensed gadgets.

Licensed Android gadgets are people who have handed Google’s Compatibility Take a look at Suite (CTS) and are accredited to ship with Google Play Providers, Play Retailer, and Play Defend.

In apply, this encompasses all mainstream gadgets from Samsung, Xiaomi, Motorola, OnePlus, Oppo, Vivo, and the Google Pixel line.

Non-certified gadgets are these from Huawei, Amazon Fireplace tablets, and shady Chinese language TV containers or smartphones that use closely modified OS pictures and questionable elements.

These gadgets will not be topic to the brand new rule enforcement, and their customers will have the ability to proceed sideloading APKs from unverified and nameless builders.

46% of environments had passwords cracked, almost doubling from 25% final yr.

Get the Picus Blue Report 2025 now for a complete have a look at extra findings on prevention, detection, and information exfiltration traits.

Get the Blue Report 2025