Obfuscate the code and recompile it, sign it with a certificate that's filled out fully. When you generate your certificate for signing, make sure you fill in the state and info. I've seen things flag for the certificate info missing data. Only on online scan tools tho, I've never seen any AV flag any APK unless it was an exact match. Recompiling with a single edit was enough to 'bypass' the AV - however that was years ago, maybe it has changed since.
Are you using someone else's APK that's already flagged and reported? If so, edit it and re-sign it and see what happens. If it still happens, consider obfuscation
It’s honestly more complex than it seems. If you want an APK to avoid detection by antivirus:
• For standard apps, you can apply heavy obfuscation using something like ProGuard or DexGuard to make reverse engineering harder.
• If there’s any embedded malicious code, you’d actually need a dedicated crypter or packer with polymorphic capabilities so each build produces a different signature.
• Additionally, tweaking the permissions, reorganizing manifest entries, and renaming classes/methods helps lower static detection chances.
At the end of the day, remember that no method can guarantee 100% evasion against Google Play Protect or advanced EDRs, especially if signature-based scanning is triggered.
Are you using someone else's APK that's already flagged and reported? If so, edit it and re-sign it and see what happens. If it still happens, consider obfuscation