You want a game that is not available in your country, or an older version, or a modded build with unlimited coins. A search turns up a dozen sites offering the APK file. The question is whether installing it is a reasonable risk or a bad idea. This guide from Maxio Fun Studio goes through what sideloading an APK actually exposes you to, what Google's own numbers say, and what is changing in 2026.

What an APK Actually Is

An APK is the installer package for an Android app. It is the same kind of file the Play Store downloads when you tap Install. Installing one directly, from a file rather than a store, is called sideloading.

So an APK is not malware by nature. It is a container. The question is always who built it, who signed it, and what got added along the way.

The Number Google Publishes

Google states that internet sideloaded sources carry over 50 times more malware than Google Play. That figure comes from Google itself, as the justification for the policy change described further down, so read it as a vendor's own number rather than independent research. Even allowing for that, the direction is not seriously disputed.

What the store side looks like is also public. In 2025 Google says it prevented around 1.75 million policy violating apps from being published on Google Play and banned more than 80,000 developer accounts that tried to publish them. The year before that the figures were roughly 2.36 million apps and 158,000 accounts, and in 2023 around 2.28 million apps and 333,000 accounts.

Two things are worth taking from that. The store is not a clean room, since over a million bad submissions a year are arriving. But there is a filter, it rejects at enormous scale, and a random APK site has nothing equivalent.

Play Protect Still Covers Sideloaded Apps

A common assumption is that Google stops caring once you install from outside the store. That is not the case.

Google Play Protect scans all installed apps on the device, explicitly including ones that were sideloaded. It scans when an app is installed and runs periodic device scans afterwards. When it finds something harmful it notifies you, and in most cases removes the app automatically and tells you it did. It can also block an installation outright, issue privacy warnings about policy violating apps, and reset app permissions.

Apps from online sources that request particularly sensitive permissions, such as access to messages and notifications, can be blocked from installing altogether.

So sideloading is not unprotected. It is just protected by one layer instead of several, and that layer is scanning something nobody reviewed first.

Modded APKs Are the Real Problem

Most of the risk is not in sideloading a legitimate app from a mirror. It is in modded builds, the ones promising unlimited gems, unlocked levels, no adverts or premium features for free.

To make one, somebody has to take the original app apart, change its code, repackage it and sign it with their own key instead of the developer's. That is not a small edit. It means the signature no longer matches the real developer, and your phone has no way to tell whether the only change was unlimited coins or whether something else came along with it.

It also means the app can never update through the Play Store, because the signatures do not match. You are frozen on that version, including any security holes it has, and the only way to update is to go back to the same site and trust it again.

The business model matters here too. Nobody rebuilds and hosts a modified game for free out of goodwill. The hosting is paid for somehow, and the three usual ways are aggressive advert injection, bundled extra packages, or credential and data harvesting.

What a Bad Package Can Actually Do

Android's permission model limits a lot, which is worth saying plainly. An app cannot silently read your banking app's data, and modern Android sandboxes apps from each other.

The realistic risks are more mundane and more common. Overlay attacks, where a screen is drawn on top of a legitimate app to capture what you type. Accessibility service abuse, where an app granted that permission can read screen content and tap on your behalf. Silent subscription signups through premium SMS or carrier billing. Advert fraud running in the background, which costs you battery and mobile data rather than money directly. And quiet collection of contacts, messages or files if you grant those permissions without reading.

Almost all of these depend on you granting a permission at some point. The single most protective habit is reading what a sideloaded app asks for, and treating an unexpected accessibility or overlay request as a hard stop.

The 2026 Change Everyone Should Know About

This part is genuinely new and will affect people who sideload.

Google is introducing a developer verification requirement that applies to apps installed on certified Android devices, meaning devices that ship with Play Protect and Google apps preloaded. Crucially it covers all install methods, including third party app stores and plain APK sideloading, not only the Play Store.

Verification confirms who the developer is. It does not review the app's content or where it is distributed from. Developers who publish only outside Google Play get a separate console, and there is a distinct path for students and hobbyists.

The timeline Google has given runs like this. Early access to verification opened to a first group of developers in October 2025. It opens to all developers in March 2026. Enforcement begins in September 2026 in Brazil, Indonesia, Singapore and Thailand, four countries Google says have been particularly affected by app based fraud. Global rollout follows in 2027.

What that means in practice is that in those countries, from late 2026, installing an APK from an unregistered developer on a certified device is expected to be blocked. If you rely on sideloading, this is the change to track.

When Sideloading Is Reasonable

There are legitimate cases and it would be dishonest to pretend otherwise.

An app from a developer you already trust, downloaded from their own website, is usually fine. Open source apps distributed through a repository with reproducible builds are a well understood case. Beta versions handed out directly by a studio are normal. So is an internal or work app your organisation distributes itself.

The common thread is that you can identify who built the file and you got it from them, not from an aggregator.

A Practical Checklist

Before installing. Confirm the developer, and prefer their own domain over any mirror. Ask why the app is not on Play, because "not available in your region" is a different answer from "banned for policy violations". Treat any promise of unlimited currency or unlocked premium content as a reason to stop. Check the file size against the real listing, since a wildly different size means a different build.

While installing. Read the permission requests properly. Refuse accessibility access and display over other apps unless you specifically know why the app needs them. Refuse "install unknown apps" permission to any app that is not a store you chose deliberately.

Afterwards. Keep Play Protect on, in the Play Store under your profile icon. Watch for the signs of a bad install: adverts appearing outside the app, battery or mobile data use jumping, or an icon you do not recognise. If something is wrong, uninstall first, then check Settings, then Apps, then Special app access, and revoke anything you did not intend to grant.

The Honest Position From a Small Studio

We publish on Google Play, so we have an interest here, and you should weigh that.

The reason we would still argue the point is the update path. A store install updates itself, including security fixes. A sideloaded build does not, which means a problem found six months from now stays on your phone until you go looking. That gap matters more than any single download.

All four of our games are free and work offline, so there is nothing locked behind a payment that a modded version could unlock anyway. If someone is distributing a modified build of one of our games promising unlimited something, it is not ours and we would not know what was added to it.

The Short Version

An APK is just an installer, and sideloading one from a developer you can identify is a reasonable thing to do. Modded builds are a different matter, because somebody re-signed the app, broke its update path and is paying for the hosting somehow. Play Protect does still scan sideloaded apps. And from late 2026, in four countries first, unverified developers will not be installable on certified devices at all.