ADB

Russia's MinTsifry Flags Google Android Developer Verification Rules as Risk to Domestic Apps

Russia's Ministry of Digital Development is assessing new Google policies that will require developer registration for Android apps distributed outside Google Play. The changes, starting in select countries in 2026 and expanding globally in 2027, could block sideloading of Russian applications previously removed from official stores due to sanctions. Minister Maksut Shadaev described the scenario as a potential barrier where users may no longer freely install APK files from third-party sources. Google plans to retain advanced modes and ADB installation options with extra warnings for unverified apps. Custom firmware projects such as LineageOS have stated their devices will remain unaffected by the verification system. Russian banks, marketplaces, and other services that rely on direct APK distribution are viewed as the most exposed.

Google Introduces Multi-Step Verification for Android APK Sideloading to Combat Fraud

Google has begun rolling out an enhanced installation flow for Android apps installed outside of Google Play. Users must first confirm that no one is coercing them to enable unknown sources, then reboot their device and wait 24 hours before the option becomes available. The new process includes explicit warnings about scammers who pressure victims into enabling sideloading, noting that legitimate organizations never require this setting. After the waiting period, users can grant the permission for seven days or indefinitely. The change does not affect ADB installations, preserving a workaround for advanced users. Google states the delay is intended to give people time to reconsider before enabling potentially risky settings. An Android Authority poll showed 88 percent of respondents expect further restrictions in the future.

Google Quietly Rolls Out Android Developer Verifier App to Curb APK Sideloading Fraud

Android users are discovering a new system application called Android Developer Verifier with the package identifier com.google.android.verifier that Google installs automatically through system updates without any separate consent prompt. The service prepares devices for upcoming restrictions on installing APK files from unknown sources by checking whether an app is registered to a verified developer who has passed identity verification and supplied legal information to Google. This verification does not guarantee an application is safe but allows Google to associate it with a specific individual or company, helping combat social-engineering scams in which fraudsters pressure victims into disabling protections and installing malicious APKs. To install software from an unverified developer, users will need to enable developer mode, confirm they are not under duress, reboot the device, wait 24 hours, and re-authenticate with PIN or biometrics. The new requirements begin on 30 September in Brazil, Indonesia, Singapore, and Thailand, with worldwide expansion planned for 2027 and later. While the app can currently be removed, it is unclear whether future updates will restore it, and advanced users retain the option to sideload via ADB, which bypasses the new checks entirely.

RedHook Android Trojan Automatically Enables Wireless ADB Debugging to Hijack Devices Without Root or User Interaction

The RedHook trojan, first identified in July 2025, has gained a novel capability that allows it to independently activate wireless ADB debugging on infected Android devices, granting system-shell privileges without requiring root access or any victim interaction. Infection begins through social engineering calls or messages impersonating bank or government officials, tricking users into installing malicious APKs hosted on legitimate platforms such as GitHub repositories and Amazon S3 storage. Once installed, the malware obtains accessibility service permissions and then silently navigates device settings, taps the build number seven times to unlock developer options, and enables wireless debugging. Leveraging code derived from the popular Shizuku tool, RedHook launches its own ADB client to connect directly to the local debugging server, bypassing the need for a computer. With elevated privileges, the trojan can install or uninstall applications, modify protected settings, grant itself permissions, and exfiltrate data and screen recordings over encrypted channels while employing multiple persistence techniques including mutual process resurrection and post-reboot restoration. Attacks have so far been concentrated in Southeast Asia, particularly Vietnam and Indonesia. Security experts recommend installing apps only from official stores and exercising caution with accessibility permission requests.