Identify the publisher
If the app is listed on Google Play, compare the developer name and contact details with a source you already trust. An icon and filename can be copied.
Keep Play Protect enabled
Google Play Protect checks apps from Google Play and other sources. It may warn about or block harmful apps. If a message asks you to disable it to finish an installation, stop and confirm where the file came from.
Check requested permissions
Review what the app requests and why it needs that access. Take extra care with requests to read messages or control the screen. If you have already installed an unfamiliar app, use Play Protect to scan the device and review permissions in Android Settings.
Sources Google Play developer information and Google Play Protect.