Samsung’s One UI 9.0 to Block Phishing Apps at Runtime on Galaxy

Samsung is moving Galaxy device security from install-time blocking to runtime blocking. The company said on June 16 that its new Phishing App Risk Alert, built into One UI 9.0, will forcibly prevent malicious apps from running even if they slip past the install check. New foldable phones set to launch in the second half of 2026 will be the first to ship with the upgrade.

Korea recorded 23,360 voice phishing cases in 2025 with 1.2578 trillion won in damages, the scale of the problem Samsung cited to explain the move. Samsung is also widening on-device AI call screening and a deep-learning message filter to more of the lineup. Voice phishing alerts on current Galaxy phones are reaching 84% usage, the rate Samsung reported for the default-activated call alert. Samsung said the protections will also reach older Galaxy devices that update to One UI 9.0.

What One UI 9.0 Adds This Fall

The new version of Samsung’s Android skin ships with the new foldable phones planned for the second half of 2026. It is the most consequential security refresh on Galaxy in two years, and most of the changes sit in the same place: the path between an app arriving on a phone and that app being able to do harm. One UI 9.0 checks Galaxy Store reputation data at the moment a user installs an app, then keeps checking afterward. If an app installed earlier is later flagged as malicious, the system forcibly blocks its launch and surfaces a prompt to delete it. The earlier version, which Samsung has been shipping since 2024, only stopped the app at the install step.

Apps that arrive via remote control, or within hours of a suspected voice phishing call, get a different treatment. When the user tries to run them, the phone shows a warning notification and pushes for deletion. Real-time security policy updates get a usability upgrade alongside the new protections. On devices running One UI 8.5 or higher, including the Galaxy S26 series, users can now pick whether the policy downloads over Wi-Fi or mobile data, with the patches that feed into this channel tracked in Samsung’s monthly security bulletin.

New foldable phones planned for H2 2026 will be the first to ship with One UI 9.0. Z Fold 8 production raised, Z Flip 8 cut ahead of that launch. Samsung has not yet published a full list of older devices that will receive the update.

What lands with One UI 9.0:

• Phishing App Risk Alert pulls Galaxy Store reputation data into the install check.
• Already-installed apps get a second check; malicious launches are blocked by force.
• Apps installed via remote control or right after a suspected voice phishing call get a warning prompt at launch.
• Security policy updates go real-time on One UI 8.5+ over Wi-Fi or mobile data.

How Galaxy AI Screens a Call Before You Hear It

Call Screening is already live on the Galaxy S26 series. The feature uses Galaxy AI to answer an incoming call on the user’s behalf, then hands back a text summary of the caller and the call’s purpose.

The user reads the summary, decides if it’s a scam, and rejects if so. Every step happens on the device, with no network round-trip. Samsung’s Call Screening support page documents the same on-device flow.

The Spam Filter That Has Already Blocked 400 Million Messages

Samsung’s Malicious Message Blocking is older than the One UI 9.0 push. Samsung built it with the Korea Communications Commission and the Korea Internet & Security Agency (KISA), and it has been running on domestic Galaxy phones since September 2024. The system filters messages against three signals: caller number, embedded links, and spam keywords, all provided by KISA. The cumulative count through April 2026: about 400 million malicious messages blocked.

Block with Intelligence is the deep-learning layer that landed with the Galaxy S25 series and any device running One UI 7.0 or later. The model retrains on roughly 500,000 data points a month from KISA. It learns to classify and block messages related to illegal gambling, loans, stocks, and smishing.

The Suspected Voice Phishing Call Alert sits on top, running by default on devices with One UI 8.0 or higher. The AI listens in real time during a live call and surfaces ‘doubt’ and ‘warning’ markers as the risk level changes. Samsung reports 84% usage of that alert as of April 2026. The 84% figure is from the company’s own usage data, not a third-party measurement.

Key figures behind the Galaxy security push:

• 23,360 voice phishing cases reported in Korea in 2025.
• 1.2578 trillion won in voice phishing damages in Korea in 2025.
• 400 million malicious messages blocked between September 2024 and April 2026.
• 500,000 KISA data points per month used to retrain the Block with Intelligence model.
• 84% usage rate of the Suspected Voice Phishing Call Alert as of April 2026.

Voice Phishing in Korea Hit 1.2578 Trillion Won in 2025

Samsung framed the new features as a response to 1.2578 trillion won in voice phishing damages recorded in Korea in 2025. The National Police Agency recorded 23,360 cases that year, the case count Samsung cited. The Suspected Voice Phishing Call Alert ships in a default-activated state so the user doesn’t have to opt in. During a live call, the AI reads the conversation and surfaces ‘doubt’ and ‘warning’ markers as the risk level shifts. Users hear the alert in real time, before they have to decide whether to engage.

KISA, the National Police Agency, and the National Forensic Service each push indicators that flow into the policy updates. The S26 series can already pull those updates in real time, with the user picking mobile data or Wi-Fi. One UI 9.0 will widen the same channel to every device that upgrades.

Samsung’s announcement also pointed to a wider set of protections already running on Galaxy. Privacy displays, privacy notifications, automatic security risk blocking, protection of stolen devices, private sharing, and security Wi-Fi round out the stack. These have shipped on Galaxy before, alongside the anti-fraud features. The One UI 9.0 release layers the new protections on top of the existing set.

We are moving beyond the simple framework of personal information protection to build a preemptive security system that predicts and defends against threats in real time.

A Samsung Electronics official gave that statement in comments reported by the Korea Economic Daily on June 16, 2026. The same comments pointed to stolen device protection and automatic security risk blocking as the next areas for the company to push.

What Lands When

Some of the work is already shipping. The Malicious Message Blocking filter has been running on domestic Galaxy phones since September 2024. Block with Intelligence went live on the Galaxy S25 series with One UI 7.0. The Galaxy S26 series has Call Screening, real-time security policy updates, and Adaptive Mode scaling the S26 processor in real time.

The major step up arrives with One UI 9.0 in the second half of 2026, and the new foldable phones will be the first to ship with it. None of the new One UI 9.0 protections require a new device, though. Older Galaxy phones that can run the update will get the same phishing app blocking when One UI 9.0 lands.

Frequently Asked Questions

Which Samsung phones will get the new phishing app blocking?

New foldable phones launching in the second half of 2026 will be the first to ship with One UI 9.0 and the new runtime phishing block. Samsung has not said which older Galaxy devices will get One UI 9.0. The S26 series already pulls the same security policy feed in real time, giving it a head start on the rollout.

When does One UI 9.0 launch?

Samsung has not given a specific date for the One UI 9.0 release. The new foldable phones planned for the second half of 2026 will be the first devices to ship with it. Older Galaxy devices typically receive the new OS in waves over several months after the flagship launch.

Does the new protection work on apps already installed?

Yes. One UI 9.0 checks the Galaxy Store reputation data both at install and afterward. An app installed earlier that gets flagged as malicious later will be blocked from launching and prompted for deletion. The same applies to apps that arrive through remote control or in the hours after a suspected voice phishing call.

Is voice phishing protection on by default?

Yes. The Suspected Voice Phishing Call Alert ships in a default-activated state on One UI 8.0+ devices, so users don’t have to opt in. Samsung reports 84% usage of the feature as of April 2026. The AI reads the live call and surfaces ‘doubt’ and ‘warning’ markers as the risk profile changes.