How Applore's Suspicious App Checker works, and its limits

Before you change anything

What the check compares

Applore’s Suspicious App Checker looks at every app installed on your phone and compares it with a threat list in three ways:

• the app’s package name, the unique ID every Android app has, such as com.example.app
• the app’s signing certificate, the digital signature its developer uses. A match here still counts if the app was renamed.
• the app’s file fingerprint, a code worked out from the app’s installation file on your phone. It matches one exact build of an app.

The threat list combines several public sources:

• the stalkerware indicators published by Echap under the CC BY 4.0 licence. They cover stalkerware, apps sold to secretly monitor another person, and a separate set of watchware, monitoring apps such as parental control or employee tracking tools that are usually installed openly.
• the Mobile Verification Toolkit indicators (MIT licence), which list commercial spyware apps that researchers have documented.
• ESET’s published indicators (BSD 2-Clause licence) for harmful Android apps.
• a short list Applore maintains itself, such as antivirus test apps and stalkerware product names.

Known harmful apps are never matched by package name alone. Repackaged harmful apps often reuse the name of a popular app, so a name match could flag the genuine app. They are matched only by signing certificate or exact file fingerprint.

How the list reaches your phone. A person reviews each update and publishes it by hand. Applore checks for a new signed list about once a day when the phone is online. It checks the signature and rejects any file that was changed, damaged or smaller than expected, and then keeps using the list it already has. A copy also comes with the app. Checking for an update downloads a file and sends nothing about your apps.

None of these sources is complete. Echap states that its indicators are not a complete list of stalkerware and that there is no guarantee they are accurate, and a new version of an app can appear before any list includes it. That is why Applore also looks for warning signs.

Google Play Protect results

If Google Play Protect is on, Applore also asks it which installed apps it reports as harmful, and lists them with Play Protect named as the source. Play Protect is Google’s scanner, built into Android phones with Google Play. If Play Protect is off, or the phone does not have Google Play services, this part of the check is skipped and the rest carries on. When Play Protect is off, the Suspicious App Checker shows a note so you can turn it back on. What Google Play Protect checks explains its own limits.

Behaviour signals Applore scores

For apps that do not match the list, Applore scores signals that monitoring apps often show. Each one on its own is common in normal apps too.

Being installed from outside an app store is a gate, not evidence on its own. An app installed from a file with a visible icon reaches High only when another strong sign backs it up: a hidden icon, both accessibility and notification access, a system-like name, a developer test certificate, or access to at least four of microphone, camera, location, messages, call history and contacts while set to keep running and start with the phone. A call recorder you installed yourself can look like the last case, so you can mark it as trusted.

A copy of a popular app on its own is Worth a look: modified versions and official downloads from a developer’s website look like this too. It reaches High only with a hidden icon or accessibility, notification or device admin access.

Applore skips system apps and itself. Apps installed by the phone maker’s own firmware, such as region or carrier apps, are treated like app-store installs.

What the levels mean

Every flagged app gets one of these levels, using the same words as the app:

Known monitoring appHighWorth a lookNot flagged

• Known monitoring app: the package name, signing certificate or file fingerprint matches known stalkerware on the list, a known monitoring app was installed from a file and hides its icon, or an app from outside a store uses a known stalkerware product name and can use sensitive access.
• High: installed from outside an app store with strong warning signs, such as a switched-off icon, or a hidden icon together with accessibility, notification or device admin access. An app that matches a known harmful app by certificate or file, or that Google Play Protect reports as harmful, is also High wherever it came from. An antivirus test app shows here too, marked as a harmless test threat.
• Worth a look: some warning signs, or a known monitoring app installed from an app store. Review it when you have a moment.
• Not flagged: no match and not enough signs. This is not proof that the app, or the phone, is fine.

Inside Applore, About this app explains each finding in plain words: what the app can see or do, where it came from, when it was installed and why it was flagged.

Monitoring apps and stalkerware

Family, parental and employee apps from Google Play are labelled monitoring apps, not stalkerware. They are usually installed openly and can be legitimate, but they can also be misused. An app installed from an app store can reach Worth a look at most, unless it matches the threat list or Play Protect reports it. Monitoring apps and stalkerware explains the difference.

Removed from Play: a separate list

Applore also shows Removed from Play: installed apps that appear on a downloaded list of apps Google removed from Google Play for policy reasons, mostly adware or fraud. It is not a spyware or malware check, and it is kept apart from the Suspicious App Checker. It never raises an app’s stalkerware level and never sends a reminder on its own.

When checks run

Applore asks for your consent before it reads your list of apps for the first time. After that, checks run:

• when you open Applore
• in the background on a schedule, including a daily re-check of every installed app
• when apps are added or updated, as Android reports those changes

Android’s battery saving can delay background checks, so a new app may not be checked straight away.

If Applore finds a Known monitoring app or High result, it reminds you later and again until you act on it: after about an hour, later that day, the next day, then daily for a week and weekly after that. Swiping a reminder away does not clear the finding. A finding is resolved when the app is removed, or when you mark it as trusted with your App Lock PIN or pattern. Worth a look results show in the list without a reminder.

What Applore cannot do

Applore also cannot see which special access another app has been granted for some settings, such as usage access or drawing over other apps. It can only see that the app asked for it.

Some kinds of monitoring are outside what any app check can see:

• implants in the phone’s system software or tools that need a rooted phone
• attacks that need no app at all, such as zero-click exploits
• spying through a shared or signed-in account or cloud service. Safety Check guides you through those settings, but it cannot inspect them for you.
• network traffic, and call or message forwarding set up with your carrier

What is and is not sent

• The check runs on your phone. The detection uploads nothing about your apps, and the findings stay on the device.
• Threat-list updates are downloads only. Applore fetches the signed list from applore.io. Like any web request, this shows your IP address to the server, but it carries nothing about your apps.
• Play Protect is asked on the phone. If Play Protect is on, Applore asks it through Google Play services on your phone.
• No package names go to analytics. Analytics events about the check carry counts, not app names.
• One exception, App Category. When you open App Category in the App Manager, package names are sent to Applore’s server to group apps by category. This is a separate feature, disclosed in the privacy policy.
• The report leaves only if you share it. An evidence report is created on your phone and leaves it only through Android’s share sheet, to the place you choose. See sharing a record of what Applore found.

Get support

The Applore app includes support contacts for India, the United States and the United Kingdom, plus global options. If you live somewhere else, search for a domestic abuse helpline in your country. Support hotlines lists where to start. If you are in immediate danger, contact your local emergency number.

For the list of third-party data and licences Applore uses, see credits. All safety guides are on the safety hub.