Beware: 239 Dangerous Android Apps Found on Google Play with 40M+ Installs

According to Zscaler, Inc.'s ThreatLabz 2025 report, Google Play hosts 239 malicious Android applications that have been downloaded 42 million times, with attackers disguising them in the Tools category to target users in hybrid and remote work environments. The energy sector saw a 387% increase in attacks year over year, underscoring how threat actors are shifting to critical infrastructure.

The report notes a 67% year‑over‑year rise in Android malware transactions, with spyware and banking malware continuing to pose significant risks worldwide. It also highlights IoT attack activity where Mirai, Mozi and Gafgyt together account for about 75% of malicious payloads, and identifies India as the top target for mobile threats at 26%, followed by the United States at 15% and Canada at 14%.

The research further points to new threats such as Android Void malware infecting 1.6 million Android TV boxes, and Xnotice, a RAT aimed at job seekers in the oil and gas sector in the Middle East and North Africa. Overall, the findings emphasise a shift towards mobile and IoT threats, with adware now representing 69% of mobile cases and Joker malware dropping to 23%.