One in three Android apps on non-Google stores are malicious, study finds

Research by Opswat suggests as many as a third of apps on unofficial app stores contain malicious code

Almost a third of Android apps on third-party app stores contain some form of malicious software, according to research from cybersecurity firm Opswat.

Knock-off versions of popular apps such as Twitter and Angry Birds dominate the list of suspicious downloads, while one-shot joke apps such as 'screen crack' make up the rest.

The firm downloaded almost 12,000 app files from various sources of Android apps other than the official Google Play store, and loaded them into their proprietary anti-malware system Metascan, which flagged 32% of the apps as suspicious.

Metascan works by using multiple anti-malware libraries, and the majority of the apps it highlighted were marked as malware by just one service. Additionally, many files were picked up because they had been classified as adware, "which is not universally considered malware," says Opswat's director of professional services, Dan Lanir.

But even when only counting apps which were flagged by at least two libraries, and which were flagged for something other than being adware, almost one in ten qualified.

The news illustrates a long-running problem for Android: the system's openness is frequently taken advantage of by malicious actors. While the Google Play store is largely safe – except for scam apps such as Virus Shield, which cost $3.99 and did absolutely nothing – a selling point of Android is that the OS will run apps downloaded from other stores.