It hasn't been too long since Google took legal action to remove Vanced. The loss of the YouTube mod, which enabled some Premium features for everyone without needing to pay, was mourned by its large userbase. After Google succeeded in stopping its development, it sure looks like it's now going after its download methods, as it appears that Google Play Protect is starting to flag Vanced Manager as a harmful app, telling people to uninstall it.

As spotted by Mishaal Rahman on Twitter, version 2.6.0 of the Vanced Manager app is being flagged as a malicious app on Android phones. We can confirm this is also happening on our end — I've downloaded 2.6.0 from APKMirror and Play Protect is showing me a warning as early as during the install process.

Attempting to install Vanced Manager, or performing a device scan with the app installed, will tell you that it "tries to bypass Android's security protections." A loose argument could be made that Vanced Manager treads on this line, since the app can use root to install apps, and the Play Protect warning is supposed to show up for apps abusing root and elevated privileges.

Still, the timing sure smells fishy. The Play Protect feature is meant to guard your phone from actual malware, and if it's being leveraged as a tool to enforce Google's legal challenges, it can make users lose trust in it. It's also only happening with version 2.6.0 of the app — I tried to install the newer 2.6.2, which installs just fine and is not flagged upon a device scan. And as far as we can tell, there's nothing particularly malicious about 2.6.0 that is not on 2.6.2.

There's no arguing the fact that Vanced infringed on YouTube's terms of service, and Google is very well within its right to take it down, but telling users that it's malware in an attempt to get users to uninstall it is probably a bit of a stretch.