fraudulent applications Archives

AppWizard

August 4, 2026

Google is introducing mandatory identity verification for Android app developers

Google will require mandatory identity verification for all developers creating applications for the Android platform, affecting those from countries under U.S. sanctions, such as Russia, Iran, Cuba, and North Korea, who will be excluded from the verification system and may not distribute their apps internationally. The new regulations apply to developers of apps for Android 7 and later versions.

AppWizard

August 4, 2026

DoubleVerify finds dozens of Android apps a month showing ads after calls

A recent analysis by DoubleVerify engineers has identified a trend in mobile advertising known as AfterCall ads, where applications display advertisements immediately after a phone call ends. This practice generates hundreds of millions of impressions monthly and raises concerns about user experience and brand integrity. AfterCall applications operate using three components: a misleading permission, a Broadcast Receiver to capture end-of-call events, and an Activity to display ads. The SYSTEMALERTWINDOW permission allows these apps to show content over others, often granted under false pretenses. They utilize Android's telephony system to trigger ads post-call and employ tactics to obscure their presence, such as removing themselves from the recent apps list and using innocuous icons. Detection is challenging due to the lack of shared codebases and the obfuscation techniques used. The scale of the issue is significant, with numerous AfterCall applications identified monthly, negatively impacting user experience and raising concerns for advertisers.

AppWizard

August 1, 2026

Third-party app stores are about to take over Google Play. Here’s how to prepare

Alternative third-party app stores are becoming more prominent on Android, with major companies developing their own storefronts to bypass Google. These stores will be accessible for download directly from the Google Play Store in the U.S. for the first time. This shift is driven by developers' dissatisfaction with the "app tax" imposed by Google and Apple, along with international regulatory efforts like Europe’s Digital Markets Act, which require tech giants to open their platforms to competition. While this change offers more choices for users, it also raises security concerns as the Google Play Store's protective measures may be weakened, leading to potential risks from counterfeit app stores. Additionally, the rise of third-party stores may complicate subscription management and billing, as each store will likely implement its own payment system. This fragmentation could increase the risk of data breaches and complicate user experience. The future may see a competitive landscape similar to streaming services, potentially driving Google to improve its offerings.

AppWizard

July 27, 2026

My parents’ Android phones were ruined by invasive ads. Here’s how I fixed them for good

Mobile advertising on Android devices has seen a rise in deceptive pop-ups that mimic legitimate notifications or system updates, leaving many users, particularly less tech-savvy individuals, vulnerable. A personal experience highlighted this issue when a family member fell for a misleading PDF ad, leading to the installation of multiple fraudulent applications. Recently, similar deceptive ads were encountered on YouTube, raising concerns about the safety of family members who rely on their devices for important tasks. Discussions on platforms like Reddit have pointed out the prevalence of misleading ads on family-friendly platforms. The author expressed a desire to block all ads if companies cannot ensure their safety. To address the issue, the author sought an ad-blocking solution that allows for remote management and network-wide filtering, ultimately choosing NextDNS. This content filtering solution offers a free account with sufficient monthly DNS queries and supports individual profiles for tailored settings. The setup process for NextDNS involves creating profiles for each family member, allowing for distinct settings and blocklists, and configuring devices with the provided DNS-over-TLS endpoint details. While NextDNS is effective, it does not eliminate all ads, particularly those from platforms like YouTube, indicating that additional measures may be necessary for comprehensive security. Regularly reviewing app permissions and uninstalling unnecessary applications are also recommended for enhancing security.

Tech Optimizer

July 15, 2026

Can Chromebooks Get Viruses? How to Protect Your Device

Chromebooks are designed with robust security features, including sandboxing, Verified Boot, automatic updates, data encryption, and Recovery Mode, which collectively reduce the risk of malware infections. However, they are still vulnerable to threats such as malicious Chrome extensions, scam Android apps from third-party stores, phishing attacks, and risks associated with using Developer Mode and cloud storage. Users can identify potential malware through signs like slow performance, unexpected pop-ups, and unusual battery drain. To remove malware, users should eliminate suspicious extensions, uninstall dubious apps, run antivirus scans, enable Google Play Protect, or perform a Powerwash to reset the device. To protect their Chromebooks, users should avoid Developer Mode, check app permissions, use two-factor authentication, verify website URLs, and use a VPN on public Wi-Fi.

AppWizard

May 20, 2026

Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid Requests Using 455 Apps

Cybersecurity researchers have identified an ad fraud and malvertising operation called Trapdoor, targeting Android users with 455 malicious applications and 183 command-and-control domains. Users often download these disguised apps, which initiate malvertising campaigns and lead to further downloads of malicious applications. At its peak, Trapdoor generated 659 million bid requests daily, with over 24 million downloads of the associated apps, primarily from the United States. The operation exploits install attribution tools to activate malicious activities only for users acquired through fraudulent ad campaigns, while suppressing such behavior for organic downloads. Trapdoor employs advanced evasion techniques, including obfuscation and impersonation of legitimate software, to avoid detection. Google has removed the identified malicious apps from the Play Store in response to the threat.

AppWizard

May 9, 2026

Fake Call History Apps Stole Payments From Users After 7.3 Million Play Store Downloads

Cybersecurity researchers from ESET have discovered 28 fraudulent applications on the Google Play Store that falsely claimed to provide access to call histories for any phone number. These apps have been downloaded over 7.3 million times, with one app alone accounting for over 3 million downloads. The operation, named CallPhantom, primarily targeted Android users in India and the Asia-Pacific region. Users were lured into subscription services, paying for access to fictitious data, including call histories and SMS records, but received only randomly generated information. Some apps were published under the developer name "Indian gov.in" to create a false sense of trust. Payments were processed through the Google Play Store or third-party applications like Google Pay and Paytm. Users who subscribed via Google Play may be eligible for refunds, while those who used third-party payment methods may not be able to recover their funds. The fraudulent activity may have been ongoing since at least November 2025.

AppWizard

May 8, 2026

Scam Android apps on Google Play got millions of downloads from a creepy pitch

Researchers uncovered a scam involving 28 fraudulent applications on the Google Play Store, collectively called "CallPhantom," which garnered over 7.3 million downloads. These apps promised access to call logs, SMS records, and WhatsApp history for any phone number, but users received fabricated data after paying a fee. The apps varied in appearance but shared a common strategy of generating random phone numbers and pairing them with pre-existing names and call details. Some requested email addresses to send the 'retrieved' history, but none had the necessary permissions to access the claimed data. Payment methods included Google Play’s official billing system and third-party platforms, with some apps misleading users into staying on subscription screens. ESET reported these apps to Google on December 16, leading to their removal from the Play Store.

AppWizard

May 8, 2026

Fake call logs, real payments: How CallPhantom tricks Android users

A series of fraudulent applications known as CallPhantom have been identified on the Google Play Store, claiming to provide access to call logs, SMS records, and WhatsApp call history for a fee. A total of 28 CallPhantom apps were reported, with over 7.3 million downloads. These apps falsely generated random phone numbers and fabricated data, misleading users into paying for nonexistent services. The apps primarily targeted Android users in India, utilizing UPI for payments and often sidestepping Google Play's official billing system. Users expressed frustration in negative reviews after being scammed. The investigation revealed two clusters of deceptive applications: one that presented hardcoded data and another that promised to send call histories via email after payment. Refunds may be possible for subscriptions made through Google Play, but users who paid outside the platform must contact their payment provider or the app developer for resolution.

AppWizard

January 30, 2026

DoubleVerify warns of ‘zombie’ Android app fraud surge

DoubleVerify has raised concerns about a mobile scam involving the hijacking of dormant Android developer accounts, referred to as "zombie" accounts, which are exploited to publish fraudulent gaming applications on Google Play. This new tactic allows fraudsters to bypass automated checks due to the accounts' history of legitimate activity. The fraudulent apps generate invalid traffic, drain advertiser budgets, and excessively consume device battery power. DoubleVerify has identified unusual traffic patterns, such as surges at early morning hours, which do not align with typical gaming behavior, indicating the presence of bot clusters generating ad requests. Specific examples include dormant accounts that suddenly shifted to publishing gaming apps after years of inactivity. The reliance on developer history as a trust signal poses risks for advertisers, as it can lead to distorted campaign measurements and brand risks. DoubleVerify advocates for real-time behavioral analysis to enhance detection and protection against these threats.