Apple and Google Tighten Mobile App Controls Through Telemetry and Sideloading Limits
Apple introduced Personalized Collections in the App Store, a recommendation feature built on detailed user telemetry that researchers at Mysk said logs every tap, app usage pattern, downloads, and potentially behavioral signals such as typing speed. The researchers reported that this analytics collection cannot be disabled and that related records appear in Apple account data exports from privacy.apple.com, prompting criticism over the granularity of the data and the lack of an opt-in model for personalization.
Google separately outlined a stricter Android sideloading process called Advanced Flow for apps from unverified developers, adding several barriers including developer mode activation, anti-coaching checks, a device restart with reauthentication, biometric or PIN confirmation, and a mandatory 24-hour waiting period. Google said internet-sideloaded apps are linked to far higher malware rates than Play-distributed apps and plans to deliver the controls through Google Play Services, but the move has also raised concerns that the company is using security justifications to further centralize control over how users discover and install mobile apps.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
3 events from the most recent confirmed update back to the earliest known activity.
Google to begin regional rollout of sideloading limits
Google said the new sideloading mechanism, implemented through Google Play Services, will begin rolling out for apps in select regions starting in September 2026. The change affects installation of apps from unverified developers rather than removing sideloading entirely.
Google announces stricter Android sideloading flow
Google said it plans to add a new Advanced Flow for sideloading Android apps from unverified developers, including developer mode, anti-coaching checks, restart and reauthentication, biometric or PIN verification, and a 24-hour cooling-off period. Google framed the change as a security measure to reduce malware risk from internet-sideloaded apps.
Apple introduces Personalized Collections in the App Store
Apple introduced a new App Store discovery feature called Personalized Collections that recommends apps based on a user’s interests, app usage, and downloads. Security researchers Mysk said the feature is powered by extensive App Store analytics that log user interactions and cannot be turned off.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple and Google tighten and reshape app distribution through geoblocking and alternative app store programs
Apple began restricting **US App Store** access to certain **ByteDance-owned apps**, using increasingly sophisticated location-determination and geoblocking mechanisms. Reporting highlighted Apple’s use of signals such as GPS, Wi‑Fi country codes, SIM information, and potentially IP-based location checks (as reflected in App Store legal terms) to decide whether apps subject to regional legal restrictions can be offered; some users reported partial workarounds via VPNs, though results are inconsistent. Google announced **Play Store policy changes** following its settlement of the **Epic Games** dispute, expanding developer billing options, adjusting fee structures, and introducing a **Registered App Stores** program to streamline installation of third-party Android app stores that meet Google’s safety/quality requirements. The rollout is staged by region (starting in the EEA/UK/US), and is positioned as enabling more alternative distribution while maintaining payment and ecosystem security controls—an approach that contrasts with Apple’s tighter, location-enforced gating of app availability and marketplace access.
Jun 29, 2026
Android Tightens Sideloading With Developer Verification ‘Accountability Layer’
Google is preparing an Android change that adds an **“Accountability Layer”** to sideloaded (third‑party) apps, introducing a higher-friction installation flow intended to make users acknowledge the risks rather than banning sideloading outright. Google’s Matthew Forsythe said advanced users will still be able to proceed via an *Install without verifying* option, while Android’s developer verification requirements are being expanded, including a new account type aimed at students and hobbyists that can distribute apps with limited reach without completing full verification. The move aligns with continued growth in Android malware distributed via sideloaded APKs, which threat researchers report remains a primary infection vector despite protections like **Google Play Protect**. Kaspersky reported preliminary 2025 data showing Android threat detections rising by nearly half, with Q3 detections up **38%** versus Q2 and sharp growth in **trojan banker** activity; attackers commonly deliver malicious APKs through messaging apps (often using deceptive filenames like `party_pics.jpg.apk`) and then propagate further via victims’ contact lists, with search-engine spam and email lures also used to drive installs outside official app stores.
Jun 29, 2026
Google to Require App Verification for Android Sideloading with Power User Bypass
Google has announced a new policy requiring all Android apps installed outside the Google Play Store to undergo developer verification, aiming to curb the rise of malware and scam campaigns exploiting sideloading. The company cited increasingly aggressive online threats and the use of social engineering tactics that prompt users to bypass existing security warnings, leading to the installation of malicious applications. Under the new system, unverified apps will be blocked from installation on Google-certified devices, with the goal of making it harder for threat actors to distribute harmful software. In response to backlash from users and developers concerned about the impact on Android's openness, Google has stated that it will provide an exemption mechanism for "experienced users" or power users, though the specifics of this bypass have not yet been finalized. The move represents a balancing act between enhancing platform security and maintaining the flexibility that has traditionally set Android apart. Google has previously faced criticism for similar restrictions and appears to be adjusting its approach to address both security and user autonomy concerns.
Jun 29, 2026