Even though official app stores are vigorously policed, moderator services can't always catch malicious apps before they're uploaded. Every year a vast range of malicious apps are deleted on Google Play only after victims have been infected. Cybercriminals gather on the Darknet – a whole underground digital world with its own rules, market prices, and reputational institutions – to buy and sell Google Play malicious apps, and additional functions to upgrade and even advertise their creations. To publish a malicious app, cybercriminals need a Google Play account and a malicious downloader code (Google Play Loader). On the Darknet, we found messages from cybercriminals complaining how it is now much harder for them to upload their malicious apps to official stores.