In short: Google has started installing a system service called Android Developer Verifier on phones running Android 8 and newer — without a separate prompt. It is meant to let only apps from verified developers be installed and to block the malicious APKs that phone scammers push. What unsettles users is that the service arrived quietly and cannot be turned off the usual way.
What happened
Over the summer of 2026, Android owners began noticing a new system app on their devices — Android Developer Verifier (package com.google.android.verifier). It ships with system updates, installs itself and by default does not ask for consent. The rollout was reported by Russia's Anti-Malware.ru (20 July 2026), and Google's plans are confirmed by international outlets and the official Android Developers Blog.
The service is part of a broad developer-verification programme. Google frames it as anti-fraud: criminals call a victim, frighten them with a "criminal case" or family trouble, and pressure them into disabling protection and installing a malicious APK. That scenario is all too familiar in Russia — we covered it in our note on the surge of Android banking trojans. The new check is meant to break that chain at the moment of installation.
How it will work
From 30 September 2026, certified devices will only be able to install and update apps from developers who have passed Google's identity verification. The rule starts in Brazil, Indonesia, Singapore and Thailand, with a global rollout planned from 2027. The Android Developer Verifier service itself is still inactive for most users — for now it is simply pre-installed in advance.
Installing an app from an unverified developer will still be possible, but harder: you will need to enable developer mode, confirm that no one is coercing you, restart the device, wait 24 hours and re-authenticate with a PIN or biometrics. These hurdles are deliberate — so a scammer on the phone cannot rush a victim through installing malware.
What it means for your privacy
There are two sides to this. The upside: less chance that a data-stealing app lands on your phone — real protection, especially for people vulnerable to social engineering. The downside is a question of consent and control: the service was placed quietly, cannot be disabled through normal settings, and the decision about which apps are "allowed" is centralised in one company. Privacy experts point out that the more pre-installed, non-removable software a device carries, the more it matters to understand what data it collects and what permissions your apps request.
For now the Android Developer Verifier can be removed by hand, but how it behaves after future updates is unknown. For an ordinary user there is no direct "right now" threat: the service does not read your messages or watch your screen. It is more a reason to be deliberate about what is installed on your phone.
How to keep your device and data safe
Install apps only from trusted sources. Official stores and developers' own sites are safer than a random APK from a link in an SMS or messenger. Never install an app because a stranger asked you to during a phone call.
Check permissions and keep the system updated. Limit app access to SMS, Accessibility services and files, and apply Android security updates promptly.
Encrypt your traffic on other people's networks. Control over app installation does not protect the traffic itself: on open Wi-Fi an outsider can see which services you connect to and try to insert themselves into the connection. A VPN routes your traffic through an encrypted tunnel and hides your real IP address, complementing device hygiene at the network level. LiMP VPN is a no-logs service for iOS and Android — see the features and plans, and more privacy news on our blog.
Sources
This report is based on coverage by Russia's Anti-Malware.ru (20 July 2026), a report by Help Net Security, and Google's official Android Developers Blog.