Mod menus and cracked-game APKs: the malware hiding inside “unlock everything” downloads
Photo by Pandhuya Niking on Unsplash
Your kid has been stuck on the same level for a week, or wants a skin their friends have and you won’t pay for. Then someone at school mentions a “mod” version of the game: unlimited coins, everything unlocked, free. It isn’t in the Play Store. It’s a file from a website, and it installs with a couple of taps. Most of the time, that file is where the trouble starts.
What is a mod APK, and why do kids want one?
An APK is the install file for an Android app. The Play Store hands you APKs quietly in the background. A “mod APK” is a copy of a real game that someone has changed and posted on their own site: a cracked paid game, a “mod menu” with cheats, or a version with in-game currency already unlocked.
For a kid, the appeal is obvious. The game is the same one they already play, the download page looks professional, and a friend says it worked for them. Nobody involved thinks of it as “installing software from a stranger”, but that is exactly what it is.
Why are modded game APKs a malware risk?
The person who changed the game can also add anything else they like. Nobody reviews the file before it reaches your kid’s phone. Common extras are aggressive adware, apps that quietly sign the phone up for paid services, and “infostealers” that collect saved passwords and logins, including the game account the kid was trying to improve.
The other giveaway is the permissions. A game has no reason to ask for SMS access, Accessibility, or “display over other apps”. A modded one sometimes does, because that’s how it reads one-time codes or takes over the screen. We covered what those permissions unlock in our post on the app permissions kids grant.
How common is it?
Very. In its 2025 safety recap, published in February 2026, Google says Play Protect’s real-time scanning “identified more than 27 million new malicious apps from outside Google Play” during 2025. The same post says Google blocked 266 million risky installation attempts through its enhanced fraud protection that year (Google, Keeping Google Play & Android app ecosystems safe in 2025).
Those numbers cover every kind of app from outside the store, not only games. But games are one of the most common reasons a kid installs something from a website in the first place.
This is a different problem from fake app clones, which sneak into the official store. Mod APKs never go through the store at all, so even the store’s imperfect checks don’t apply.
What actually helps
- Keep Play Protect switched on. It’s on by default. In the Play Store, tap the profile icon, then Play Protect, and check it’s still scanning. It is the main thing catching those 27 million apps.
- Leave “Install unknown apps” off. Android asks for this permission separately for each app that can install files, such as Chrome, a file manager, or a chat app. On most phones it’s under Settings → Apps → Special app access → Install unknown apps. If none of them are allowed, a downloaded APK can’t install.
- Talk about the trade, not just the rule. “Free coins” is the bait. Explain that the price is usually their account, their saved passwords, or your phone bill, and that you’d rather talk about a real purchase or a time-limited reward.
- If one is already installed, uninstall it, run a Play Protect scan, then change the passwords for the game account and the Google account from a different device.
Where Paxio fits, and where it doesn’t
Paxio is not an antivirus and doesn’t scan files for malware. Play Protect and the “Install unknown apps” setting above do that job, and they’re already on the phone.
Where App Blocking helps is visibility. Every app your kid installs, including one that came from a website, shows up in your App Blocker list with its own Allowed or Blocked switch. So a “Minecraft Mod Menu” that appears on Tuesday is something you can notice, block, and ask about, rather than something you find out about from a strange charge on your phone bill.
Frequently asked questions
Are mod APKs safe to download?
Not reliably. A mod APK is a changed copy of a game posted outside the Play Store, so nobody checks what was added to it. Some are just cheats. Others carry adware, subscription fraud, or password-stealing malware, and you usually can't tell which from the download page.
How do I stop my child from installing APK files?
Keep Google Play Protect switched on and leave "Install unknown apps" turned off for every app, especially browsers, file managers, and chat apps. You'll find it under Settings → Apps → Special app access on most Android phones. Without that permission, a downloaded APK won't install.
What should I do if my child already installed a modded game?
Uninstall it, then run a Play Protect scan from the Play Store. Change the passwords for the game account and the Google account from a different device, and check the phone bill and any linked payment methods for charges you don't recognise.