Introduction

The freeMalwareDetection SDK enables your Android application to identify potentially harmful applications installed on the same user device.

The SDK evaluates the device ecosystem using on-device metadata analysis — including app hash-based and package name-based blocklists, requested app permissions, and the source of installation. All scanning runs entirely on the device, ensuring that no application inventory or user data is ever transmitted to external servers.

It operates asynchronously in the background to avoid impacting your app's performance. High-risk findings are reported directly to your application via callbacks, allowing you to implement custom, context-aware security logic.

---

Supported Platforms

Android

Flutter

React Native

Capacitor

Cordova

Kotlin Multiplatform

---

Technical Scope and Threat Model

The Android application ecosystem and distribution models allow attackers to distribute malicious apps (often requesting sensitive permissions) designed to exploit or intervene in other applications on the device. Users are frequently tricked into sideloading these applications from untrusted sources via social engineering.

Such malware is often created and distributed specifically to target high-value applications. The freeMalwareDetection SDK defends against these threats by analyzing metadata and heuristic signals — evaluating requested permissions, installation sources, and known blocklists — entirely on the device, with no internet connection required.

For applications requiring an additional layer of verification against a continuously updated global threat database, see Premium Malware Detection.

To ensure a secure environment, the freeMalwareDetection SDK is specifically engineered to identify apps that facilitate activities such as:

• Remote Access Trojans (RATs) & Overlays: Applications requesting aggressive permission sets to control the device remotely, draw fake UI layers (e.g., login screens) over your application, or read the content of the screen.

• Communication Interception: Apps designed to make or accept calls, intervene in network communications, or act as SMS stealers to intercept incoming 2FA codes.

• Accessibility Abuse & Keylogging: Malicious apps abusing Android Accessibility Services to autonomously click buttons on behalf of the user, approve background transactions, or log keyboard inputs.

---

Key Features

To tackle these complex threats without compromising your app's UX, privacy, or battery life, the SDK provides the following core capabilities:

• Customizable Blocklists: Easily define and manage multiple types of blocklists (e.g., hash-based or package name-based) to tailor malware detection to your specific threat model.

• Asynchronous Scanning: All evaluations are performed in a low-priority background thread, ensuring minimum impact on your application's foreground performance.

• 100% On-Device Privacy: All scanning is completely self-contained. No app inventory, hashes, or behavioral data leaves the device.

• Comprehensive Threat Context: Receive detailed telemetry and reasoning about detected threats to inform your app's defensive response effectively.

• Google Play Compliant: The default malware detection works out-of-the-box without requiring extensive Google Play policy reviews. (Optional deep scanning via QUERY_ALL_PACKAGES is available for advanced enterprise use cases).