Android malware detection collapses when the context stage comes out

Six Android malware detectors in wide research use, including Drebin, MalScan, MaskDroid, and the LLM-based LAMD, flagged more than half the benign apps in a test set assembled from 49 Google Play categories, according to a new study. The detectors collapsed when apps requested permissions typical of legitimate tools, such as storage, contacts, SMS, and call logs, producing false positive rates that render them unreliable for real-world deployment.