潜在有害应用 (PHA)
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
潜在有害应用 (PHA) 是指可能会给用户、用户数据或设备带来风险的应用。这些应用通常统称为恶意软件。我们为不同类型的 PHA（包括特洛伊木马、钓鱼式攻击和间谍软件应用）制定了一系列类别，并且还会不断更新和添加新类别。
可能有害？
在描述恶意应用时，“可能”一词的含糊不清，让人感到困惑。Google Play 保护机制会移除被标记为“可能有害”的应用，因为应用确实包含恶意行为，而我们只是不确定应用是否有害。这里之所以使用“可能”一词，是因为恶意应用的运作方式因各种变量而异，因此对一部 Android 设备有害的应用可能不会给另一部 Android 设备带来风险。例如，搭载最新版 Android 的设备不会受到有害应用的影响，这类应用会使用已废弃的 API 执行恶意行为，但搭载 Android 早期版本的设备可能会面临风险。移动账单欺诈会给连接到服务运营商的设备带来风险，但仅连接到 Wi-Fi 的设备不受这些应用的影响。
如果应用明显会给部分或所有 Android 设备和用户带来风险，就会被标记为 PHA。
用户所需的 PHA
某些可能会削弱或停用 Android 安全功能的应用不属于 PHA。这些应用能够提供用户所需的功能，例如启用设备的 root 权限和其他开发功能。虽然这些应用可能有害，但用户是有意安装它们，因此 Google Play 保护机制管理它们的方式与其他 PHA 不同。
当用户开始安装被归类为“用户需要”的应用时，Google Play 保护机制只会向用户发出警告一次，告知其应用的潜在危险。用户可以决定是否继续安装。安装后，用户需要的分类可防止 Google Play 保护机制发送更多警告，这不会影响用户体验。
分类
有多种类别可用于对 PHA 进行分类，这有助于 Play 保护机制检测它们并确定要采取的正确操作。这些类别包括特洛伊木马、间谍软件和钓鱼式攻击应用等恶意应用，以及用户想要的应用。如果 Play 保护机制检测到 PHA，则会显示警告。对于某些恶意应用，Play 保护机制会自动停用或移除应用。当 Play 保护机制检测到 PHA 包含多种类别的功能时，会根据有害程度最高的特征对应用进行分类。例如，如果某个应用同时属于勒索软件和间谍软件，则“验证应用”消息会将其标识为勒索软件。
您可以点击此处查看当前的 PHA 类别和定义。
本页面上的内容和代码示例受内容许可部分所述许可的限制。Java 和 OpenJDK 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-07-26。
[null,null,["最后更新时间 (UTC)：2025-07-26。"],[[["\u003cp\u003ePotentially Harmful Applications (PHAs), often called malware, pose risks to users, data, or devices.\u003c/p\u003e\n"],["\u003cp\u003ePHAs are categorized by type, such as trojans or spyware, with Google Play Protect continuously updating these categories.\u003c/p\u003e\n"],["\u003cp\u003e"Potentially harmful" signifies a confirmed risk to some or all Android devices, varying based on factors like Android version.\u003c/p\u003e\n"],["\u003cp\u003eUser-wanted PHAs, like rooting apps, are acknowledged as potentially harmful but receive a single warning due to intentional installation.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Play Protect classifies PHAs into various categories to trigger appropriate actions, prioritizing the most harmful characteristics in cases of overlap.\u003c/p\u003e\n"]]],["Potentially Harmful Applications (PHAs) are apps that risk users, data, or devices. Google Play Protect flags apps with malicious behavior as PHAs, removing or disabling them based on their harm level. PHAs include trojans, spyware, and phishing apps. User-wanted apps, like those for rooting, are treated differently: a one-time warning is displayed during installation and further warnings are not displayed. PHA detection uses categories, with apps classified by their most harmful traits, such as ransomware.\n"],null,["# Potentially Harmful Applications (PHAs) are apps that could put users, user\ndata, or devices at risk. These apps are often generically referred to as\n*malware*. We've developed a range of categories for different types of\nPHAs, including trojans, phishing, and spyware apps, and we are continuously\nupdating and adding new categories.\n\n### Potentially harmful?\n\nThere is some confusion around the ambiguity of the word *potentially*\nwhen used to describe malicious apps. Google Play Protect removes apps that have\nbeen flagged as Potentially Harmful because the app does contain malicious\nbehavior not because we are simply unsure if the app is harmful or not. The word\npotentially is used here because malicious apps function differently depending\non a variety of variables thus an app that is harmful to one Android device\nmight not pose a risk at all to another Android device. For example, a device\nrunning the latest version of Android is not affected by harmful apps which use\ndeprecated APIs to perform malicious behavior but a device that is still running\na very early version of Android might be at risk. Mobile billing fraud poses a\nrisk to devices connected to service carriers but devices which only connect to\nWIFI are not affected by these apps.\n\nApps are flagged as a PHA if they clearly pose a risk to some or all Android\ndevices and users.\n\n### User-wanted PHAs\n\nSome apps that can weaken or disable Android security features aren't\ncategorized as PHAs. These apps provide functionality that users want, such as\nrooting the device and other development features. Even though these apps are\npotentially harmful, users install them intentionally, so Google Play Protect\nmanages them differently than other PHAs. \n\nWhen a user begins to installI an app that's classified as user-wanted,\nGoogle Play Protect warns the user of the app's potential hazards just once. The\nuser can decide whether to continue with the installation. After installation,\nthe user-wanted classifications prevents Google Play Protect from sending\nadditional warnings, so there's no disruption to the user experience.\n\n### Classifications\n\nThere are several categories for classifying PHAs that help Play Protect\ndetect them and determine the right action to take. These categories include\nmalicious apps like trojans, spyware, and phishing apps, as well as user-wanted\napps. If Play Protect detects a PHA, it displays a warning. For certain\nmalicious apps, Play Protect automatically disables or removes the app.\nWhen Play Protect detects that a PHA contains features from multiple\ncategories, it classifies the app based on the most harmful characteristics. For\nexample, if an app applies to both ransomware and spyware categories, the Verify\nApps message identifies it as ransomware.\n\nYou can view the current PHA categories and definitions\n[here.](/android/play-protect/phacategories)"]]
