How to Scan APK Files for Malware on Android (2026 Guide)

Sideloading APKs is convenient, but it comes with real risk — a malicious APK can steal your data, show intrusive ads, or spy on you. The good news: scanning an APK for malware before you install it takes under a minuteand blocks 99% of threats. Here's exactly how to do it, from quick online checks to thorough on-device scans.

Golden rule: always scan before you install — not after. Once malware is running, it can be very hard to remove.

1. Quick online scan: VirusTotal (fastest, most thorough)

The best first step is a free, 60-second cloud scan that checks the file against 60+ antivirus engines:

1. Open VirusTotal.
2. Click Choose file (or just drag your APK in).
3. Wait for the scan. It usually takes under a minute.
4. Look at the results: if anyengine flags it, treat the file as suspicious. A clean “0/60+” result is a strong green light.

Why it's great: runs on cloud, doesn't slow your phone, and checks far more engines than any single phone app.

2. On-device: Google Play Protect (built-in, automatic)

Every Android phone has Play Protect built in:

• It scans APKs during installautomatically when you turn on “Scan apps with Play Protect”.
• Manual check: open the Play Store → tap your profile → Play Protect → Scan.
• Enable “Improve harmful app detection” to send unknown apps to Google for review.

Play Protect isn't perfect, but it catches most known malware and blocks dangerous apps in real time.

3. Third-party antivirus apps (extra layer)

• Malwarebytes for Android — excellent at detecting adware and spyware.
• Kaspersky / Bitdefender / Avast — full-featured, but often request more permissions.
• Bitdefender Mobile Security — lightweight, good background scanning.

Install one of these, then use its “Scan file/APK” feature on any downloaded APK before installing.

4. Manual checks before you install (no tools needed)

• Check the source — only download from known, reputable sites (official site, APKMirror, APKPure, gptoapk.com). Avoid random share links.
• Check the signature — on APKMirror, verified apps show the official developer signature.
• Check requested permissions — a flashlight app asking for contacts, SMS, and location is a red flag.
• Check the developer name— make sure it matches the official developer (e.g., WhatsApp is “WhatsApp LLC”, not some random name).

5. My recommended 3-step routine

1. Upload the APK to VirusTotal → confirm clean (0 detections).
2. Enable Play Protect → let it scan during install.
3. Review permissions on the install screen → reject anything with excessive permissions.

That's it. This routine catches ~99% of threats before they ever touch your phone.

6. What to do if you already installed a suspicious app

• Immediately uninstall it: Settings → Apps → [app] → Uninstall.
• Revoke risky permissions for other apps you no longer trust.
• Run a full device scan with Play Protect and your antivirus app.
• If you think data was stolen, change passwords for sensitive accounts.