Mobile Malware · Malware Basics · Lesson 1 of 5

What Mobile Malware Is

Learn the words analysts use, and how common phone malware really is.

Malware, PHAs and the gray zone

You met malware back in Android App Security. In this track you'll look at it the way an analyst does, so the words need to be precise.

Malware is software written to act against the person using the device: stealing data or money, spying, or taking control. The key word is intent. A buggy app that crashes and loses your notes is annoying, but it isn't malware.

Google uses a broader label for Android: potentially harmful applications, or PHAs. Its Play Protect documentation lists categories such as backdoors, billing fraud, stalkerware, hostile downloaders, phishing, ransomware, rooting, spam, spyware and trojans. A few examples of how Google defines them:

• Trojan: an app with a harmless looking part and a hidden harmful part. A working flashlight that also steals your contacts is a trojan.
• Billing fraud: code that charges you in an intentionally deceptive way, like signing you up for paid services.
• Hostile downloader: code that isn't harmful itself but downloads other PHAs. (Security vendors often call this a dropper.)
• Backdoor: code that lets someone run unwanted operations on the device remotely.

Then there's the gray zone. Grayware is a vendor term for apps that aren't clearly criminal but behave badly: adware that floods you with ads, or apps that quietly collect more data than they need. Google tracks a related group it calls mobile unwanted software (MUwS), such as apps that collect your phone number, email or list of installed apps without consent. Google tracks it separately from malware.

Why does this matter? Because reports from Google, Apple and security companies each count slightly different things. When you read that a vendor found "thousands of threats", check whether that includes adware and aggressive data collection, or only clearly malicious apps. The answer can change the number a lot.

How common is it, really?

Headlines can make phone malware sound like it's everywhere. The real numbers are more reassuring, with one big caveat.

Google's Android Security & Privacy 2018 Year in Review is one of the most detailed public datasets. In 2018, only 0.08% of devices that installed apps exclusively from Google Play were affected by PHAs. Devices that also installed apps from outside Play were hit at 0.68%, about eight times as often. Across all Android devices running Play Protect, the figure was 0.45%. Google also noted that much of what it counted in places like the US was low-impact, such as click fraud apps and rooting tools users installed on purpose.

The scale today is still huge, simply because there are billions of phones. In its review of 2025, published in February 2026, Google said it stopped over 1.75 million policy-violating apps from being published on Google Play, banned over 80,000 developer accounts, and that Play Protect identified more than 27 million new malicious apps from outside Play. Play Protect now scans over 350 billion apps a day. Big numbers of attempts, small chance for any single careful user.

Android vs iOS. iPhones see less commodity malware, mostly because apps normally come only from the App Store (with some alternative marketplaces in the EU) and every app runs in a tight sandbox. Apple says the App Store rejected over 1.9 million submissions in 2024. But iPhones aren't immune. In February 2025, Kaspersky reported a crypto-stealing component, SparkCat, inside apps on both Google Play and the App Store, the first stealer it had found in Apple's store. And as you saw in iOS Internals, iPhones are prime targets for expensive mercenary spyware.

The fair summary: Android's openness gives attackers more routes, especially through sideloading. Your own habits (where you install from, whether you update) matter more than the logo on your phone.