Google's AI defenses blocked Play Store malware in 2025 - AI News Today Recency

# Google's AI Defenses Blocked Play Store Malware in 2025

Google's commitment to protecting its Android ecosystem reached new heights in 2025, with the company's AI-powered security systems preventing over 1.75 million policy-violating apps from reaching the Google Play Store[1]. Alongside these preventative measures, Google banned more than 80,000 malicious developer accounts attempting to distribute harmful applications[1]. These figures underscore how advanced artificial intelligence and real-time defense mechanisms are becoming essential tools in the ongoing battle against cybercriminals who increasingly leverage AI to create sophisticated threats.

AI-Powered App Prevention at Scale

Google Play Protect, Android's built-in defense system, scanned over 350 billion Android apps daily throughout 2025, demonstrating the massive scale at which Google operates its security infrastructure[1]. The system's proactive approach goes beyond just blocking apps on Google Play—it continuously monitors both applications from the official store and those downloaded from alternative sources[1]. In a particularly impressive achievement, Google Play Protect's real-time scanning capability identified more than 27 million new malicious apps from outside Google Play, warning users or blocking these threats before they could cause harm[1].

The prevention of 1.75 million apps from being published represents a significant decrease from previous years, which actually signals success rather than failure[5]. This reduction indicates that Google's stricter policies and enhanced verification requirements are discouraging bad actors from even attempting to publish malicious apps in the first place[1]. By raising the bar for entry into the ecosystem through mandatory pre-review checks and developer verification initiatives, Google has effectively reduced the pathways available to threat actors[1].

Evolving Threats: The Rise of AI-Powered Malware

Despite Google's defensive successes, the threat landscape continues to evolve in alarming ways. Security researchers at ESET discovered PromptSpy, the first known Android malware to leverage generative AI as part of its execution flow[2][3]. This malware uses Google's Gemini AI service to interpret on-screen elements and provide dynamic instructions for maintaining persistence on infected devices[2][3]. While the AI component represents only a small portion of PromptSpy's overall toolkit, it demonstrates a troubling new capability: the ability to adapt to virtually any device, screen layout, or Android operating system version[2][3].

PromptSpy's primary function involves deploying a virtual network computing (VNC) module that grants attackers remote access to victim devices, allowing them to capture lockscreen data, take screenshots, record activity, and block uninstallation[2][3]. The malware, which impersonates Chase Bank through a variant named MorganArg, was distributed through a dedicated website rather than the Google Play Store[3][4]. Despite this, Google's App Defense Alliance partnership ensured that researchers shared findings with Google, and Android users with Google Play Protect enabled remain automatically protected against known versions of the malware[2][3].

Strengthened Developer Accountability and Ecosystem Defenses

Google's 2025 security strategy emphasized accountability and compliance by design. The company implemented several initiatives designed to make it harder for bad actors to operate within the ecosystem[1]. Developer verification requirements, mandatory pre-review checks, and enhanced testing requirements have all contributed to raising standards across Google Play[1]. These measures complement Google's broader real-time security enhancements, including in-call scam protections that help users avoid fraud and other threats[1].

The banning of 80,000 malicious developer accounts represents a crucial step in preventing repeat offenders from simply creating new identities and continuing their harmful operations[1]. By holding bad actors accountable and preventing them from hiding behind anonymity, Google aims to create a more trustworthy ecosystem where honest developers can operate with confidence[1]. Looking forward, Google plans to continue expanding Android developer verification programs to further strengthen these protections[1].

Frequently Asked Questions

How does Google Play Protect work to keep Android devices safe?

Google Play Protect operates as Android's built-in malware defense system, scanning over 350 billion apps daily across both the Google Play Store and alternative app sources[1]. It uses AI-powered real-time scanning to identify potentially harmful applications and either warns users or blocks the threat automatically[1]. Users should keep Google Play Protect enabled to benefit from these continuous protections[1].

What is PromptSpy and how does it use artificial intelligence?

PromptSpy is the first known Android malware to incorporate generative AI into its execution flow[3]. It uses Google's Gemini AI service to interpret on-screen elements and receive dynamic instructions on how to keep itself pinned in the device's recent apps list, preventing users from easily removing it[2][3]. While AI represents only a small part of PromptSpy's overall functionality, it enables the malware to adapt to different devices and operating system versions, potentially expanding the pool of vulnerable targets[2][3].

How many apps did Google block from the Play Store in 2025?

Google prevented over 1.75 million policy-violating apps from being published on Google Play in 2025[1]. Additionally, the company banned more than 80,000 malicious developer accounts that attempted to distribute harmful applications[1]. These figures represent a decrease from previous years, which indicates that stricter policies are discouraging bad actors from attempting to publish malicious apps[5].

Is PromptSpy available on the Google Play Store?

No, PromptSpy has never been available on the Google Play Store[3][4]. The malware was distributed exclusively through a dedicated website that victims had to be tricked into visiting[2]. However, Android users with Google Play Protect enabled are automatically protected against known versions of PromptSpy[2][3].

What new security measures is Google implementing in 2026?

Google plans to continue investing in AI-driven defenses to stay ahead of emerging threats and will maintain focus on embedding checks to help developers build compliant apps by design[1]. The company will also roll out expanded Android developer verification programs to hold bad actors accountable and prevent them from operating anonymously[1]. These initiatives aim to equip developers with tools needed to build apps safely while making the ecosystem more trustworthy overall[1].

How can I protect my Android device from malware like PromptSpy?

The most important step is to ensure Google Play Protect is enabled on your device, which happens by default on Android devices with Google Play Services[3]. Additionally, avoid downloading apps from unofficial sources or clicking links from untrusted websites that claim to offer legitimate applications[2]. If you suspect your device is infected with PromptSpy, you can remove it by rebooting your phone into Safe Mode, which disables third-party applications and allows you to uninstall them normally[2].