###### Abstract  
As Android malware grows increasingly sophisticated, traditional detection methods struggle to keep pace, creating an urgent need for robust, interpretable, and real-time solutions to safeguard mobile ecosystems. This study introduces YoloMal-XAI, a novel deep learning framework that transforms Android application files into RGB image representations by mapping DEX (Dalvik Executable), Manifest.xml, and Resources.arsc files to distinct color channels. Evaluated on the CICMalDroid2020 dataset using YOLO11 pretrained classification models, YoloMal-XAI achieves 99.87% accuracy in binary classification and 99.56% in multi-class classification (Adware, Banking, Riskware, SMS, and Benign). Compared to ResNet-50, GoogLeNet, and MobileNetV2, YOLO11 offers competitive accuracy with at least 7\(\times\) faster training over 100 epochs. Against YOLOv8, YOLO11 achieves comparable or superior accuracy while reducing training time by up to 3.5\(\times\). Cross-corpus validation using Drebin and CICAndMal2017 further confirms the model's generalization capability on previously unseen malware. An ablation study highlights the value of integrating DEX, Manifest, and Resources components, with the full RGB configuration consistently delivering the best performance. Explainable AI (XAI) techniques--Grad-CAM, Grad-CAM++, Eigen-CAM, and HiRes-CAM--are employed to interpret model decisions, revealing the DEX segment as the most influential component. These results establish YoloMal-XAI as a scalable, efficient, and interpretable framework for Android malware detection, with strong potential for future deployment on resource-constrained mobile devices. A Article]YoloMal-XAI: Interpretable Android Malware Classification Using RGB Images and YOLO11][PERSON] \({}^{\star}\)  
1][PERSON]  
High-profile incidents underscore the sophistication of these threats. A fake Telegram Premium app harvested user data through phishing sites imitating official platforms [4]. The _Spyrtacus_ spyware, embedded in WhatsApp clones, intercepted messages and remotely activated microphones and cameras [5]. In parallel, over 22,800 phishing apps mimicking TikTok, WhatsApp, and Spotify were detected in 2024 alone, targeting user login credentials [6]. To combat Android malware, researchers have developed various detection techniques, broadly categorized into static analysis and dynamic analysis [7]. Static analysis examines an application's source code, permissions, and structural attributes without execution. While computationally efficient, this approach is vulnerable to obfuscation techniques--such as code encryption, packing, and reflection--which allow malware to evade detection by modifying its signature. Dynamic analysis, on the other hand, monitors an application's runtime behavior in a controlled sandbox environment, offering better resilience against obfuscation. Tools such as DroidBox [8] exemplify early efforts in this space by tracking information leaks, file access, and network activity during execution. However, their high computational cost makes them impractical for real-time, large-scale deployment. Additionally, signature-based detection [9], which relies on predefined malware patterns, struggles to identify zero-day attacks and polymorphic malware, where attackers frequently modify the code to bypass detection. The emergence of machine learning (ML) and deep learning (DL) has significantly improved malware detection capabilities by leveraging large datasets to identify malicious patterns. However, these models face several critical challenges. Obfuscation techniques, such as code packing, encryption, and runtime modifications, enable malware to disguise itself, reducing the effectiveness of ML/DL models [10]. Additionally, deep learning models often function as black-box systems, providing little interpretability. This lack of transparency poses a challenge in cybersecurity applications, where explainability is crucial for trust, regulatory compliance, and decision validation.