Android has become a terrifying minefield of vicious malware fraught with peril, judging from some recent headlines. A nasty app called Android Defender Platinum holds devices hostage for $100, a pirated copy of Jay-Z’s Magna Carta Holy Grail app includes a Trojan that may target financial transactions on the phone, and CITEWorld reports that another Trojan –  the most insidious yet – “may give serious pause to IT pros considering a large Android implementation.”  It all might be enough to make you wonder if Google’s platform is in peril.

It’s easy to see why Android is a huge target for malware, of course. It’s the dominant mobile operating system worldwide, claiming a market share in the ballpark of 70 percent, which provides a huge target for nefarious developers. It’s much more fragmented than Apple’s tightly controlled iOS, which means a far smaller percentage of users are running the latest – and most secure – version of the platform. And while iOS apps are distributed exclusively through Apple’s App Store, Android titles can be downloaded from an ever-increasing number of third-party distributors.

Security vendors fan the flames

But it’s important to remember that those who are sounding the malware alarms are often security firms looking to sell their “solutions” to problems they’re hawking. Bluebox Security, Kaspersky Lab, McAfee, NQ – they’ve all managed to get substantial publicity lately by pointing out potential threats in Android. And more often than not, those potential threats are entirely overblown.

That isn’t to say that real, potentially dangerous malware doesn’t exist in Google Play. While Google has made great strides in policing its flagship app store for malware (thanks largely to Google Bouncer filter), some tainted titles still get through. The security company F-Secure last month alerted Google to a Bad Piggies knockoff in Google Play that contained an unusual number of permissions that might have been used for underhanded purposes. Google promptly pulled the app, which had seen 10,000 downloads. Bouncer also missed BadNews, a nasty piece of code that was integrated into 32 different apps in Google Play before Google removed it last month.

But as Juniper Networks reported a few weeks ago, the vast majority of malware in Android resides in those third-party app stores. Juniper found 76 app-distributor sites in the U.S. that were hosting apps with dangerous code; China and Russia combined had more than 300 such sites. So users who download Android apps only from Google Play – an act that requires them to actively uncheck a security box to allow downloads from unknown sources — are highly unlikely to run into mobile malware trouble.

Education is the most powerful weapon

There are plenty of other things consumers can do to avoid Android malware, too. Porn sites and other sketchy destinations should be avoided, of course, and users should never download anything from any suspicious site or from unsolicited emails or texts. Users also should inspect apps carefully, read reviews and even check the permissions before they download anything from Google Play or anywhere else. And they should check regularly to make sure they’ve downloaded every available update for Android.

Those are all rules IT departments must stress to their fellow employees as well as the growing BYOD trend brings more and more Android gadgets into the enterprise. Some organizations may want to install antivirus software on their employees’ Android devices as well as an added layer of protection, particularly for those employees who might be inclined to ignore company policies. When it comes to the threat of malware in Android, though, education is the most powerful weapon there is.