In August 2025, security researchers pulled 77 malicious apps off the Google Play Store. Between them, they had racked up 19 million installs before anyone caught on. Some carried Anatsa, a banking trojan that quietly harvests your banking and crypto credentials. Nearly a quarter carried Joker, which can read and send your texts, make calls, grab your contacts, and sign you up for premium services you never wanted. They did not look dangerous. They looked like file managers, photo editors, and little utilities, which is exactly the point.

A few weeks later, a separate campaign turned up 224 more malicious apps with 38 million downloads between them, running an ad-fraud operation that generated over two billion fake ad requests a day off the backs of the people who installed them. Early in 2026, another 50 apps with 2.3 million downloads were found that could clone your WhatsApp session onto an attacker’s device.

And these are not freak events. In a single year, Kaspersky counted more than 600 million malware downloads from the Google Play Store.

Sit with that number. The safe store. The curated one. The one Google scans, polices, and stakes its name on. It delivered malware to phones over half a billion times in twelve months.

The store was never going to save you

Here is the thing almost everyone gets wrong about phone security. The standard advice is “only install apps from the official store.” It sounds responsible. It is also, at this point, demonstrably not enough, and the numbers above are the proof.

It is not that Google is lazy. It is that the job is impossible at the scale it operates. There are more than three million apps in the Play Store. No company, however large, can deeply audit three million pieces of constantly-updating software written by anonymous developers all over the world. Malware gets in because the math guarantees it will.

And the attackers are patient about it. One of the nastiest patterns is the app that starts out completely clean. A screen-recorder called iRecorder sat on the Play Store for eleven honest months. Then an update arrived, and buried in it was code that recorded from the microphone every fifteen minutes and shipped the audio off to a server. Nothing you could have checked at install time would have caught it, because at install time there was nothing to catch. The app you vetted and the app that betrayed you were the same app, a version apart. When one malicious developer account gets banned, the same crew simply opens another and re-uploads.

So the honest conclusion is uncomfortable: you cannot vet your way to safety by trusting the store, because the store cannot vet itself. The lever you actually control is not where your apps come from. It is how many you have.

Every app is a door you left open

Think of each app on your phone as a door. Each one is code with permissions, a network connection, and access to some slice of your life, and each one is a thing you now have to trust to stay honest through every future update. A hundred apps is a hundred doors. Most people could not tell you what half of theirs actually do, or why they are still installed.

The single most effective, least glamorous thing you can do for the security of a device is carry fewer apps. Every app you do not install is one that cannot betray you. It cannot get bought by a shady analytics company. It cannot turn malicious in an update. It cannot sit dormant for seventy-two hours and then start phishing you, the way one recent batch of Play Store apps was caught doing. It is simply not there to be a problem.

This is the part of a build we take seriously, because it is where a lot of real-world risk actually lives.

We build your loadout deliberately. You get the apps your work genuinely requires, the messengers your team uses, secure notes, a private app store, whatever the job calls for, chosen and vetted on purpose. Then we stop. There is no drawer of “might be handy someday” apps quietly accumulating permissions.

No bloatware, and this matters more than it sounds. A stock phone ships with dozens of preinstalled apps you never chose and often cannot remove. That is not just clutter. It is attack surface you did not sign up for and cannot audit, running with system privileges, updated on someone else’s schedule. Preinstalled software has been a malware vector on cheap Android hardware for years. On a build to spec, if it is on the device, it is there because you wanted it there.

A private app store instead of a lottery. When your team pulls apps from a controlled, private store rather than the open Play Store, you are not rolling the dice on whatever got past Google’s scanners this week. The catalog is known. The updates are known. Nobody on your fleet wakes up owned because a photo editor they trusted last month pushed a poisoned update overnight.

A fleet you can actually reason about. When every device carries the same short, deliberate set of known apps, you can answer the question “what is running on our phones?” with a real answer instead of a shrug. You cannot secure what you cannot inventory, and a curated loadout is an inventory by design.

The quiet math of a smaller attack surface

None of this is exotic. It is the oldest principle in security, applied to the place people ignore it most. Reduce the number of things that can go wrong. Every app removed is a permission that cannot be abused, a network call that cannot leak, an update that cannot be weaponized, a door that is simply not in the wall anymore.

The reason stock phones do not work this way is not that minimalism is hard. It is that the entire consumer model runs the other direction. Preinstalled partnerships, default apps, an app store designed to get you installing as much as possible. You are nudged, constantly, toward more. Security wants less. Those two goals do not reconcile on a device built for the mass market, which is exactly why building to spec matters. We start from zero and add only what earns its place.

Who this is for

Anyone whose phone holds something worth stealing, which, if you are honest, is everyone, but especially teams handling sensitive work, people who cannot afford a single compromised device, and anyone who has read one too many “delete these apps right now” headlines and realized the treadmill never ends. The people for whom “I only download from the Play Store” stopped being reassuring the moment they saw the download counts on the malware.

If you want a device that carries exactly what it needs and nothing that can turn on you, tell us what your people actually do. Email hello@spicycorp.com, or book a call. We will build you the shortest loadout that still gets the job done, which is also the safest one.