Mobile Malware · Detection & Defense · Lesson 1 of 5

How Platforms Fight Back

See the layers Google and Apple use to keep harmful apps off phones.

Google's layers: review and scanning

In Android App Security you met Play review and Play Protect as a user. Here's the defender's view: a stack of layers, each catching what the one before missed.

Store review comes first. Google says that in 2025 it prevented over 1.75 million policy-violating apps from being published on Google Play and banned more than 80,000 developer accounts that tried to publish harmful apps. Review mixes automated analysis with human reviewers, and Google says it now uses its generative AI models in the process too.

Review can't catch everything, because an app can pass and turn bad later, or never come from Play at all. So the second layer lives on the phone. Google Play Protect checks apps at install and scans installed apps regularly. In its February 2026 report, Google said Play Protect scans over 350 billion Android apps daily, from Play and other sources.

For apps installed from outside Play, Google documents a few checks working together:

• A match against known harmful samples Google has already cataloged.
• On-device machine learning and similarity checks that compare the app with known malware families.
• For apps it hasn't seen before, a real-time code-level scan. With your consent, the app is uploaded so Google can analyze its code.

Google says this real-time scanning flagged more than 27 million new malicious apps from outside Play in 2025. Install blocking is kept for extreme cases. Usually you get a warning.

Google also announced live threat detection in 2024. Instead of only checking an app's code, it watches behavior on the phone, such as how an app uses sensitive permissions and interacts with other apps. Google says the analysis runs on the device in a privacy-preserving way, and suspicious apps can be sent for review or turned off. Which phones have it depends on the maker and Android version.

Finally, developer verification, which you met in Android App Security, ties apps to an accountable identity. It's still rolling out, so details may change.

Apple's gates and the patch cycle

Apple takes a tighter approach. On most of the world's iPhones, the App Store is the only way to install apps, and every app goes through App Review. Apple says its App Review team evaluated more than 9.1 million app submissions in 2025 and rejected over 2 million, using a combination of expert human review and machine learning. It also reported stopping over $2.2 billion in potentially fraudulent transactions that year.

The European Union is the exception. Since iOS 17.4, EU users can install apps from alternative app marketplaces and some developers' websites. Those apps still pass notarization, a baseline check that Apple says applies to every iOS app, whatever the channel. Through automated checks and human review, notarization aims to catch known malware and other security threats. During installation, the phone also checks that the app hasn't been tampered with and came from an authorized source. Notarization isn't full App Review, though. Each marketplace runs its own review, so how carefully apps are checked depends on the store.

For the rare people facing mercenary spyware, there's Lockdown Mode, from iOS Internals, which trades features for a much smaller attack surface.

The last layer is the patch cycle, which closes the flaws attackers use.

• Android. Google publishes the Android Security Bulletin, which lists fixed flaws by severity. Since 2025, press reports say, most fixes are grouped into larger quarterly releases, while monthly bulletins focus on the most urgent issues. Phone makers then ship the fixes, so timing varies by brand and model. Your phone shows its security patch level, a date, in Settings, About phone, Android version. A level many months old means known holes are still open.
• iOS. Apple ships fixes in iOS updates and lists them on its Apple security releases page. When a flaw is being exploited, Apple often notes that it may have been actively exploited.

Store review, scanning and patches each fail sometimes. Together, they make harmful apps rare for people who stay updated and install from trusted stores.