1. A method of identifying whether a first application is malicious, the method comprising: detecting the first application being presented for installation on a processing system; scanning, via a static analysis implemented by a processor, the first application to determine whether a user interface layout of the first application is suspiciously similar to a user interface layout of a second application installed on the processing system; and when the user interface layout of the first application is suspiciously similar to the user interface layout of the second application installed on the processing system, generating an alert indicating that the first application is malicious.