McAfee discovers massive fake app campaign in Google Play Store

Share


Researchers at McAfee Labs discovered a large-scale fraudulent app campaign operating through the official Google Play Store, identifying more than 1,900 fake versions of popular applications on over 500,000 devices in over 190 countries before they were removed by Google.

The UK emerged as one of the most targeted markets worldwide, registering 11,862 detections across 10,582 protected devices and making it the eighth most affected country worldwide. UK detections account for almost 2% of total global activity, with security experts identifying 970 fake applications aimed specifically at consumers in the UK.

Scammers have strategically tailored their offers to align with what UK users are most searching for. Streaming, TV and sports apps accounted for 17% of local detections, followed by video and photo editors at 13% and gaming apps at 11%.

The fraudulent software impersonated well-known services and brands, including Netflix, PayPal, Clash of Clans, Roblox, Xbox Game Pass, CapCut, and Apple Tools – using familiar logos to trick unsuspecting users.

Instead of delivering the promised functionalities, the malicious apps redirected users into aggressive advertising funnels and fraudulent subscription schemes that charge up to $49.99 per month.

The findings illustrate a growing trend in cybercrime where threat actors are exploiting consumer trust in established brands and official app marketplaces rather than relying on complex technical exploits.

How to protect yourself

  • Install financial apps only from your bank’s own website or a verified link. If you are looking for an app store for a payment brand, you are in the exact position that this campaign is targeting.
  • Be suspicious of “Guide”, “Tutorial”, “Help” and “Tips” apps for products you already use.
  • Legitimate services do not need a third party to explain them.
  • Check the developer name, not just the app name and icon. A true brand app is published by that brand.
  • If a product doesn’t exist on your platform, no app can offer it. There is no Apple Pay, Siri or iMessage for Android.
  • Ignore installation counts as a trust signal. Some of these apps had tens of thousands of downloads.
  • Run mobile security software.

McAfee

For the latest tech stories go to TechDigest.tv

Discover more from Tech Digest

Subscribe to get the latest posts sent to your email.

Leave a Comment