Android.FakeApp
Android.FakeApp is a family of fake Android applications used by cybercriminals in fraudulent schemes. According to the provided content, these apps typically do not deliver their declared functionality and instead load websites hardcoded in their settings or otherwise redirect users to various sites. Reported destinations include fraudulent and malicious websites, phishing pages, bookmaker sites, and online casino sites. Some samples were disguised as finance-related software, while others appeared as games. Doctor Web reported Android.FakeApp as one of the most widespread Android threat families in 2025 and Q3 2025, and also identified new Android.FakeApp samples on Google Play in Q3 and Q4 2025, including apps posing as financial applications and games that under certain conditions loaded fraudulent or gambling-related websites. The content associates the family with general cybercriminal fraud activity rather than a specific named threat actor. No specific indicators of compromise beyond the family behavior and naming are provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Trojan app that opens a hardcoded website; known variants redirect users to online casino sites.
Fake-app trojan family used for fraud/phishing by loading attacker-controlled websites (e.g., investment scams, online earnings fraud, casinos/bookmakers) instead of legitimate functionality.
Fake Android applications that do not provide claimed functionality and instead load websites, including fraudulent/malicious destinations.
Fake Android apps that do not provide claimed functionality and instead load websites, including malicious/fraudulent destinations.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.