Google bulks up Android’s malware defenses to combat new tricks, including AI

Google is upgrading Android’s Play Protect malware protection system to help it spot malicious apps that change their identifiable features to avoid detection, the company has announced. “This enhancement will help better protect users against malicious polymorphic apps that leverage various methods, such as AI, to be altered to avoid detection,” Google’s blog post reads.

The update follows a rise in this so-called “polymorphic malware,” which is harder for Google’s existing systems to detect. So now, in addition to checking newly installed apps against existing scanning intelligence and using techniques like on-device machine learning, Play Protect will also recommend a real-time app scan when installing apps that haven’t been scanned before. After a code-level evaluation, Google will notify a user to tell them whether an app looks safe or is potentially harmful.

Despite the protections, researchers continue to sound the alarm over Android malware discoveries. BleepingComputer has reported on several hacking campaigns in recent months, which often distribute malware masquerading as legitimate apps like YouTube or Chrome — software that users are likely to be more willing to grant wide-ranging system permissions to. Google’s blog post notes that links to malicious app downloads are often shared via “ephemeral sources” like messaging apps. 

The new scanning feature has already started rolling out in “select countries, starting with India,” Google’s post notes, and will be available in all regions in the coming months.