A method, comprising: in an application distribution server: performing, by the server, an application distribution process for an application (206a, 206b, 206c), wherein the application distribution process comprises a plurality of phases that comprise a developer account creation phase, a risk assessment phase, an application upload phase, an application publication phase, an application promotion phase and an application download phase in sequence; detecting, at each of the plurality of phases (302, 304, 306, 308, 310, 312), whether a particular behavior corresponding to use of the application (206a, 206b, 206c) to distribute malware occurs, characterized in that the method further comprises: when an occurrence of the particular behavior is detected at the application promotion phase and/or at a previous phase (302, 304, 306, 308) prior to the application promotion phase in the application distribution process: continuing, utilizing a honeypot trap system, one or more subsequent phases after the application promotion phase and/or the previous phase (302, 304, 306, 308) prior to the application promotion phase for the application, without communicating information on the detection of the occurrence of the particular behavior; marking the application (206a, 206b, 206c) which has been promoted as a trap application without application suspension; and preventing the promoted trap application from being installed in an end-user device. in an application distribution server: performing, by the server, an application distribution process for an application (206a, 206b, 206c), wherein the application distribution process comprises a plurality of phases that comprise a developer account creation phase, a risk assessment phase, an application upload phase, an application publication phase, an application promotion phase and an application download phase in sequence; detecting, at each of the plurality of phases (302, 304, 306, 308, 310, 312), whether a particular behavior corresponding to use of the application (206a, 206b, 206c) to distribute malware occurs, performing, by the server, an application distribution process for an application (206a, 206b, 206c), wherein the application distribution process comprises a plurality of phases that comprise a developer account creation phase, a risk assessment phase, an application upload phase, an application publication phase, an application promotion phase and an application download phase in sequence; detecting, at each of the plurality of phases (302, 304, 306, 308, 310, 312), whether a particular behavior corresponding to use of the application (206a, 206b, 206c) to distribute malware occurs, characterized in that the method further comprises: when an occurrence of the particular behavior is detected at the application promotion phase and/or at a previous phase (302, 304, 306, 308) prior to the application promotion phase in the application distribution process: continuing, utilizing a honeypot trap system, one or more subsequent phases after the application promotion phase and/or the previous phase (302, 304, 306, 308) prior to the application promotion phase for the application, without communicating information on the detection of the occurrence of the particular behavior; marking the application (206a, 206b, 206c) which has been promoted as a trap application without application suspension; and preventing the promoted trap application from being installed in an end-user device. when an occurrence of the particular behavior is detected at the application promotion phase and/or at a previous phase (302, 304, 306, 308) prior to the application promotion phase in the application distribution process: continuing, utilizing a honeypot trap system, one or more subsequent phases after the application promotion phase and/or the previous phase (302, 304, 306, 308) prior to the application promotion phase for the application, without communicating information on the detection of the occurrence of the particular behavior; marking the application (206a, 206b, 206c) which has been promoted as a trap application without application suspension; and preventing the promoted trap application from being installed in an end-user device. continuing, utilizing a honeypot trap system, one or more subsequent phases after the application promotion phase and/or the previous phase (302, 304, 306, 308) prior to the application promotion phase for the application, without communicating information on the detection of the occurrence of the particular behavior; marking the application (206a, 206b, 206c) which has been promoted as a trap application without application suspension; and preventing the promoted trap application from being installed in an end-user device.