Malware — Malware policy

Apps flagged by Google Play Protect's automated scanning as containing malicious code, trojans, or exploit behavior are held regardless of intent — a legitimate SDK that behaves like known malware can trigger this.

A surprisingly common false-positive cause is an aggressive obfuscation/packing tool applied to the build, which shares behavioral signatures with actual malware packers.

The short version, in more detail

Apps that Google Play Protect's automated scanning identifies as containing malicious code, trojans or exploit behaviour are held back whatever the developer intended. A legitimate SDK that behaves like known malware can trigger it. One surprisingly common cause of false positives is an aggressive obfuscation or packing tool whose behaviour resembles that of real malware packers.

Why this rule exists

Devices store messages, financial apps and personal files, so malicious software can cause serious damage. Google has to act on what code does, because attackers will always claim good intent. Automated scanning works at the scale of the store, which means it errs on the side of caution, and developers are expected to be sure of what they ship, including components they did not write.

What this guideline covers

• Trojans, spyware, ransomware and exploit code.
• Behaviour that resembles known malware.
• Play Protect's automated scanning.
• Third-party components and build tooling.

What usually triggers this rejection

• An SDK whose behaviour matches known malware signatures.
• Heavy obfuscation or packing that looks like malware techniques.
• Unexpected data collection or remote control features.
• Attempts to gain unauthorised access to the device.
• Components pulled from untrusted sources.

How reviewers evaluate it

• Automated analysis examines code and behaviour.
• Play Protect scans apps on devices as well.
• Flagged apps are reviewed regardless of the developer's intent.
• Confirmed malware leads to removal and account action.

Common misunderstandings

• Good intentions do not change what the code does.
• Obfuscation that looks like malware can trigger detection.
• Small apps are not exempt from scanning.

Common questions