Live Android Malware Threat Feed

Name: Droidwatch Android Malware Threat Feed
Creator: Droidwatch
License: https://creativecommons.org/licenses/by/4.0/

Public, continuously updated feed of Android malware samples analyzed by Droidwatch. sha256 hashes, package names, verdicts and severity scores — ingestible by your SIEM / MISP / OpenCTI in STIX 2.1, JSON, JSONL or CSV. No registration, no API key.

Total IOCs

Last 24 h

Generated

2026-10-28T10:34:56Z

License

CC BY 4.0

Download the feed

JSON — 500 latest JSONL — streamable CSV — spreadsheet STIX 2.1 — MISP / OpenCTI

Latest 3 samples

SHA-256	Package	Verdict	Score	Seen
ca0dceb24de5bf57…	org.selpz.ikaol	High Risk	52	2026-09-26
c229cd586ba61171…	com.bjmtv.ujpmp	Malicious	70	2026-09-26
0ad36f46238c14e5…	com.nissan.golocker	High Risk	47	2026-08-16

Programmatic access: all endpoints accept ?limit (max 500), ?page, ?verdict=Malicious|High Risk|Suspicious, and ?search=<pkg>. Lookup individual hashes via GET /api/threat-feed/lookup?sha256=…. Stats via GET /api/threat-feed/stats. See the API reference.