Google adds real-time scanning in Play Protect to fight Android malware: Report

Google Play Protect adds real-time scanning to enhance Android safety. 125B daily scans detect suspicious activity & alert users. AI & polymorphic malware can bypass automated security, but Play Protect uses static analysis, heuristics & ML to identify malicious patterns.

Google announced new real-time scanning features for Google Play Protect that will help enhance the safety of Android users by making it harder for malicious apps using malware to evade detection.

Google Play Protect is a built-in protection system in Android that performs on-device scans for unwanted software and malware. The system is backed by data derived from 125 billion daily scans, a report from Bleeping Computer said.

The tool alerts users when it detects suspicious activity in an app, warning users to not proceed with its installation.

Play Protect works for apps downloaded from Google Play, Android’s official app store, as well as third-party apps and APK files downloaded from external sources.

(For top technology news of the day, subscribe to our tech newsletter Today’s Cache)

The move from Google comes as threat actors have taken to using AI and polymorphic malware to bypass automated security platforms, making scans ineffective. Once these apps are installed on a device, they pull additional code from remote servers to complete their malicious functionality.

However, Google’s Play Protect tool will not now perform real-time scanning at the code level and add recommendations to perform scans on apps that haven’t been scanned before. These scans will extract signals from the app, sending them to Play Protect backend- infrastructure for in-depth code analysis, returning a result on the app’s safety.