Practically: none, for you at least.
Don't download Microsoft Teams if it claims an app developer with an unrecognisable name and only 500 downloadeds, don't download cracked games, be wary of the obvious free-to-play clones, and if a web page shows a flashing gif warning you that Whatsapp is outdated, don't install the APK file it's trying to push through your browser. It's also important to keep your browser up to date and to think before you grant apps permission described like "control the entire screen" and "give app access to all input and screen content".
Android malware is not that different from Windows malware. It spreads through devices infected from the factory, pirated software, fake download ads, and less commonly, through clones and abandonware on official storefronts like Google Play.
This threat actor is buying abandonware and spreading viruses through updates. Dime-in-a-dozen PDF readers and file managers (that your phone already came with anyway) are at risk, but if you stick to reputable brands you'll be fine. Pick "Google Drive PDF" over "Insomnia Media PDF Viewer - Reader & Editor" with 10k downloads.
Google Play comes with an antivirus program built in (Google Play Protect) that will warn you of known risks. You can disable it if you don't want Google to know about every app you install from other sources, but if you leave it enabled you'll minimize the risk of getting infected.
If you want to be sure you're not getting infected, use F-Droid. F-Droid compiles open-source apps on their own servers, so the source code they receive is the source code the compiled APK uses. Even if your app is open source, there's no way to upload a precompiled APK to the F-Droid website. This makes introducing malware without anyone noticing quite difficult.
Don't download Microsoft Teams if it claims an app developer with an unrecognisable name and only 500 downloadeds, don't download cracked games, be wary of the obvious free-to-play clones, and if a web page shows a flashing gif warning you that Whatsapp is outdated, don't install the APK file it's trying to push through your browser. It's also important to keep your browser up to date and to think before you grant apps permission described like "control the entire screen" and "give app access to all input and screen content".
Android malware is not that different from Windows malware. It spreads through devices infected from the factory, pirated software, fake download ads, and less commonly, through clones and abandonware on official storefronts like Google Play.
This threat actor is buying abandonware and spreading viruses through updates. Dime-in-a-dozen PDF readers and file managers (that your phone already came with anyway) are at risk, but if you stick to reputable brands you'll be fine. Pick "Google Drive PDF" over "Insomnia Media PDF Viewer - Reader & Editor" with 10k downloads.
Google Play comes with an antivirus program built in (Google Play Protect) that will warn you of known risks. You can disable it if you don't want Google to know about every app you install from other sources, but if you leave it enabled you'll minimize the risk of getting infected.
If you want to be sure you're not getting infected, use F-Droid. F-Droid compiles open-source apps on their own servers, so the source code they receive is the source code the compiled APK uses. Even if your app is open source, there's no way to upload a precompiled APK to the F-Droid website. This makes introducing malware without anyone noticing quite difficult.