An APK is simply the install file for an Android app. The Play Store uses APKs too. Installing one from outside the store isn’t dangerous by itself; what matters is where it came from and what’s inside. These seven checks take a couple of minutes and catch nearly all bad files.
1. Trust the source, not the file name
A file called WhatsApp.apk can contain anything. Download from places that have a reputation to lose: the developer’s own website, GitHub releases for open-source apps, F-Droid, or well-known APK mirrors that verify signatures (such as APKMirror). Avoid links from comments, random Telegram groups and pop-up “download” buttons on ad-heavy pages.
2. Check the file size
If the real app is 90 MB and your “APK” is 3 MB, it’s not the app. Tiny APKs pretending to be big games are often downloaders that install something else. The other way round is suspicious too: a 200 MB “calculator” doesn’t make sense.
3. Scan it with VirusTotal
- Open virustotal.com in your phone’s browser.
- Tap Choose file and pick the APK (up to 650 MB).
- Wait for the result. 0 or 1 detections from little-known engines is normal. Several detections, especially from big names, means don’t install it.
Words like “Riskware” or “HackTool” often appear on emulators, root tools and game tools; that alone isn’t proof of malware. “Trojan”, “Banker”, “SMS” or “Spyware” are real red flags.
4. Look at the permissions
On Android, open Settings → Apps → the app → Permissions right after installing, before you open it. A game has no reason to read your SMS, call logs or contacts, or to ask for Accessibility access. If it does, uninstall it.
- Accessibility service: lets an app read your screen and tap for you. Banking trojans rely on it.
- Device admin: makes an app hard to uninstall.
- Display over other apps combined with Accessibility.
5. Keep Play Protect on
Google Play Protect scans apps installed from any source, not only the Play Store. Keep it on (Play Store → profile picture → Play Protect). If it warns you about a specific app, take it seriously.
6. Watch out for fake “update” prompts
Websites that say “Your Chrome is out of date, install this APK” or “Your phone has 4 viruses” are scams. Real apps update through the Play Store or inside the app itself.
7. Check how it behaves after installing
Signs that something is wrong: ads popping up outside the app, a new app icon you didn’t install, your battery draining fast, or the app’s icon disappearing after you open it. Uninstall it straight away, and if you can’t, boot into safe mode (hold the Power off option on screen) and remove it there.
| Usually fine | Be careful |
|---|---|
| Developer website, GitHub, F-Droid | Links in comments and random chats |
| File size matches the real app | Big game in a 2–5 MB file |
| 0–1 VirusTotal detections | Several detections, “Trojan” / “Banker” |
| Game asks for storage or microphone | Game asks for SMS, contacts, Accessibility |
If an install fails after these checks, our guide to fixing “App not installed” covers the usual reasons.
FAQ
Can an APK file harm my phone?
Yes, if it contains malware. Installing APKs is safe when the file comes from a trusted source, passes a VirusTotal scan and does not ask for permissions it doesn’t need.
Is VirusTotal enough to know an APK is safe?
It is a good check but not a guarantee. Combine it with a trusted source, a sensible file size and a look at the app’s permissions.
Does Play Protect scan apps not from the Play Store?
Yes. Play Protect checks apps installed from any source and warns you about known harmful apps, as long as it is turned on.
Join the conversation