Despite enhanced protections and tighter controls, Android devices face increasingly sophisticated attacks, prompting Google to bolster its defence mechanisms and user safety measures in 2025.
Android remains far more resilient than it once was, but it is not invulnerable. Security researchers and threat analysts continue to document mobile-specific attacks, from spyware and banking fraud to malicious push notifications and social engineering campaigns that exploit trust rather than software flaws. The latest examples show how quickly those tactics are evolving, even as Google adds more layers of protection to the platform.
Google Play Protect is still the core of that defence. According to Google, it now scans apps both when they are installed and afterwards, and it blocked 27 million newly identified malicious apps from outside the Play Store in 2025. The company also says it rejected 1.75 million policy-breaking apps and banned more than 80,000 developer accounts last year, while blocking hundreds of thousands of apps from excessive access to sensitive data.
The wider Android ecosystem is also getting tighter controls. Google has expanded protections that can reset permissions for apps that have not been used for some time, and it continues to rely on sandboxing to keep apps isolated from one another. At the same time, the company is moving to make sideloading harder for less experienced users, with added friction such as a cooldown period and identity checks for developers who distribute apps outside the Play Store.
That push is not happening in a vacuum. Group-IB recently uncovered a campaign called WindRelay that targeted Android users in central Europe through personalised phone calls and a remote access trojan known as SpyNote. Once installed, the malware was used to turn victims’ devices into rogue payment terminals capable of capturing contactless card data. TechRadar reported that the attackers relied on detailed personal information and sustained phone calls lasting around 13 minutes, underlining how mobile compromise is increasingly tied to fraud and manipulation rather than obvious technical exploits.
Google is also trying to cut off abuse at the notification layer. TechRadar reported that the company now blocks roughly seven billion malicious Chrome notifications a day, using tighter permission controls, rate limits and activity checks to reduce scams disguised as legitimate alerts. Together with planned spoofing protections for phone calls and live threat detection for suspicious app behaviour such as SMS forwarding, the direction is clear: Android security is becoming more proactive, but the burden still falls partly on users to be sceptical of unexpected prompts, installs and requests for sensitive access.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
