4 places you should never download Android apps from

Published Nov 13, 2026, 7:01 PM EST Sydney Butler is a technology writer with over 20 years of experience as a freelance PC technician and system builder and over a decade as a professional writer. He's worked for more than a decade in user education. On How-To Geek, he writes commerce content, guides, opinions, and specializes in editing hardware and cutting edge technology articles. Sydney started working as a freelance computer technician around the age of 13, before which he was in charge of running the computer center for his school. (He also ran LAN gaming tournaments when the teachers weren't looking!) His interests include VR, PC, Mac, gaming, 3D printing, consumer electronics, the web, and privacy. He holds a Master of Arts degree in Research Psychology with a minor in media and technology studies. His masters dissertation examined the potential for social media to spread misinformation. Outside of How-To Geek, he hosted the Online Tech Tips YouTube Channel, and wrote for Online Tech Tips, Switching to Mac, and Helpdesk Geek. Sydney also wrote for Expert Reviews UK. He also has bylines at 9to5Mac, 9to5Google, 9to5Toys, Tom's Hardware, MakeTechEasier, and Laptop Mag. Google may have introduced more friction to the process of loading apps from places other than the Google Play Store, but with enough determination you can still install pretty much any app you want. The question is: should you? There's nothing wrong in principle with side-loading apps, but when you stray outside the walled garden provided by Google or your phone manufacturer, you run a higher risk of malware infection or having your personal data stolen. Some app sources, in particular, make it more likely you'll step into a trap. Unexpected attachments in your messages Are we still doing this? Credit: Kaspersky I hate that this even has to be said, but if you get an APK file as an email or message attachment, please don't install it on your phone. Sending executable files via email is one of the oldest ways to spread malware, but just like the old PC email scams, the sender will try to hide the true nature of the file. In 2025, Kaspersky reported a scam where APK files were sent via messaging apps like WhatsApp and Telegram. As you can see in the above example provided by the company, the files are clearly marked as ".apk" but only real Android nerds know what that is. Besides, an age-old trick is to have multiple file extensions, such as ".PDF.APK", which can be confusing, but of course, only the last extension counts. An easy rule of thumb is that if your Android package installer is triggered when you tap on a file attachment, abort and delete. APK sites promising premium features for free It's easy to scam a greedy target Credit: Kaspersky Let's face it, side-loading might not be illegal, but it has been used as a way to commit piracy from the start. Premium apps like games can often be side-loaded, but that comes with the risk of malware coming along for the ride. However, it's not just people who want to play premium mobile games for free. There are plenty of utility apps with paywalls, and as Kaspersky found, people will download malware even if it clearly can't unlock what it promises. In this case, modded versions of the Spotify app from unofficial sources promise to give you free unlimited Spotify Premium listening. However, if you think about it for just a second, no app mod could achieve this. Spotify doesn't decide that you're a subscriber based on the app you're using; it keeps that information on its own servers. In some cases, this malware isn't even delivered as a complete app, but as a modification for apps you've downloaded from legitimate sources like the Play Store. Credit: Singapore Police Force I don't know about you, but I've become quite ad-blind on social media websites. My eyes just sort of glaze over until an advert is done, and I can get back to laughing at animal videos that may or may not be AI-generated. However, as the Singapore Police found, some of these adverts are actually traps, and often designed to target vulnerable populations such as senior citizens. In that specific case, the ads were for activities seniors could do in their local area. If they tapped on the ad and provided personal details as part of an expression of interest, they'd be sent infected APKs and told to install them. This is, of course, a safe-for-work version of the scam. You might have run across the adult-oriented "there are X of Y in your area" ads, but hopefully didn't click on any of them! Lookalike app stores on unfamiliar websites If it looks like a duck, walks like a duck, and quacks like a duck. It might be a phish Credit: Cyfirma We love and support the idea of alternative app stores. It's a good thing if people have a choice when it comes to where they get their software from. Unfortunately, it also opens up opportunities for fraud. You're probably familiar with phishing websites that are made to look like your bank or some other real site, but steal your information. A similar scheme is happening with app stores. For example, Cyfirma recounts how a fake version of the (real and legitimate) RuStore offered a "Telegram Premium" app which is really the FireScam malware. Because legitimate alternative app stores are often usable just from a web browser, this is a trick that can work. The solution is to use only the storefront app on your device, from the verified official source. Stick to safe neighborhoods To be absolutely clear, even mainstream app stores can run afoul of malware. However, thanks to robust security measures, the chances that you'll install a compromised app from Google or any of the sanctioned mainstream alternative app stores are quite low. Unless you absolutely know you can trust the source of the app, and the app itself, it's better to just walk away. Remember, if it sounds too good to be true, it probably is. There are many safe ways to download Android apps without using the Google Play Store, so don't install apps from any other storefront or source unless you're 100% sure you can trust it.