Google has announced the official rollout of Android developer verification to all developers, aiming to address the problem of harmful apps distributed by malicious userswho hide behind anonymity. This initiative precedes the verification requirement that will go into effect in Brazil, Indonesia, Singapore, and Thailand this September (with plans for a global expansion next year).
Android developer verification for greater user security
As part of this effort, Google is requiring app developerswho distribute apps outside of Google Play to create an account in the Android Developer Console to verify their identity. Developers who distribute apps through the official Android app marketplace and have verified their identity likely don't need to do anything else to comply with the new rules.
See also: Vertex AI vulnerability exposes Google Cloud data and files
“For the vast majority of users, the app installation experience will remain exactly the same,” said Matthew Forsythe, director of product management for Android App Security. “Only when a user tries to install an unregistered app will ADB or advanced flow. This will help us keep the broader community safe while maintaining flexibility for our power users.”
Android Studio developers can expect to see their app's registration status in the integrated development environment (IDE) in the next two months when creating a signed App Bundle or APK.
Developers who have completed the Play Consolewill see their Play apps automatically listed. If an app cannot be listed, developers are required to follow a manual app claim process.
See also: Apple: Privacy Rules for Third-Party Access to Live Activities and Notifications
Power users will still have the ability to enable sideloading of unregistered APK files through an advanced flow that requires an authentication step to confirm their intent, along with a unique, 24-hour waiting period to deter scammers.
“This flow is a one-time process for power users – but it was carefully designed to prevent scam victims from being forced to install malware,” Forsythe said.
Earlier, Sameer Samat, President of the Android Ecosystem, explained the rationale behind the 24-hour wait: “During that 24-hour period, we believe it becomes much more difficult for attackers to sustain their attack . In that time, you can likely learn that your loved one is not actually being held in jail or that your bank account is not actually being attacked.” This way, fraud and malware infection rates can be reduced.
See also: Axios Supply Chain Attack: Malicious versions distribute RAT
The problem has become serious, as according to Kaspersky, Android malware increased significantly in the first half of 2025. In the second quarter of 2025 alone, thousands of malicious APK files, including many banking Trojans. Apps installed via sideloading contain over 50 times more malware than those on the Play Store.
