Google beefs up Android security to better detect malicious apps amid spike in malware scams

SINGAPORE: Google is strengthening its Play Protect malware protection system to better detect whether an Android app may be infected with malware by "adding real-time scanning at a code level".

"This enhancement will help better protect users against malicious polymorphic apps that leverage various methods, such as AI, to be altered to avoid detection," said Google on Thursday (Oct 19).

Polymorphic malware can change its identifiable features, avoiding detection from Play Protect's current security scans. According to Google, Play Protect, which was launched in 2017, currently scans 125 billion apps daily.

The update comes amid a spike in Android malware scams in Singapore - more than 750 such cases were reported in the first half of 2023, with total losses amounting to at least S$10 million (US$7.2 million). 

Previously, Play Protect conducted real-time checks and warned users when an app was known to be malicious from existing scanning intelligence or was identified as suspicious from on-device machine learning, said Google. 

"Google Play Protect will now recommend a real-time app scan when installing apps that have never been scanned before to help detect emerging threats," added the tech giant. 

Real-time scanning will "extract important signals from the app and send them to the Play Protect backend infrastructure for a code-level evaluation".

Once the real-time analysis is complete, users will be notified if the app is safe to install. 

It added that the security protections and machine learning algorithms learn from each app submitted to Google for review, and the company also looks at thousands of signals and compares app behaviour. 

The enhanced scanning feature has already started rolling out in select countries, starting with India, and "will expand to all regions in the coming months".