Google does vet the apps to the best of their ability, and they also scan all apps that get installed to your phone. But some shady apps can still slip by from time to time. Some good rules of thumb:
- Read through some of the reviews. Users will often alert you to adware or other problems associated with the app.
- Look at how many downloads an app has, and be cautious about ones that don't have that many. Not that they're necessarily bad, but apps with tens of thousands of downloads are much less likely to be malware, because someone would have alerted Google by now.
- If you search for an app and find multiple similar-appearing apps, be very careful that you're installing the right one. Less scrupulous companies will often mimic popular apps, and some of them may be less than aboveboard.
- Although 3rd party antivirus apps are becoming less necessary now that Google scans apps, it can still be a good idea to install a well-respected security app (I use Lookout), since these companies are all about malware, and they might become aware of a threat before Google. In addition, they often have additional theft-prevention features.
- Never install an app that you downloaded as an .apk file from some random filesharing site. There's no way to tell how safe it is, and those sites often carry pirated apps as well, which is just not cool.
