Google Play Protect, the built-in malware scanner, has been updated in this build. Version 9.9.21 reportedly includes heuristics for detecting newer strains of HiddenAds and FakeBank trojans. The scan runs slightly faster and eats fewer CPU cycles in the background.

It is a clear sign of a malicious file designed to exploit users searching for “unlocked” or “premium” access. Google Play Store’s core functions are server-controlled and cannot be permanently altered by a simple APK replacement.

The 9.9.21 build carried the defining features of the version 9 family, which established the UI/UX standards still largely visible today.