Loading story…
Threat actors are exploiting Google Play’s Early Access program to distribute thousands of deceptive Android apps without public ratings or reviews, depriving prospective users of a key fraud warning signal. Promoted through TikTok, Facebook, and other social-media ads—including alleged AI-generated celebrity deepfakes—the apps promise cash, cryptocurrency, gift cards, casino winnings, premium content, or free spins but instead subject users to aggressive advertising and never deliver payouts.
Bitdefender identified recurring fraudulent game themes such as Chicken Road and Ice Fishing, alongside casino apps disguised as casual games to bypass gambling licensing, geofencing, and age-verification controls. Operators also use trademark-abuse and search-indexing tactics, initially publishing titles such as “Grand Theft Auto V (Early Access)” before renaming them; one GTA-themed imitation, “Vice Streets: Open World,” reportedly surpassed one million downloads before its removal. The campaign is primarily ad fraud rather than malware delivery, but can affect thousands of users per listing.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
The Grand Theft Auto-impersonating app “Vice Streets: Open World,” using package name com.gamblechaos.withfriends.game, was no longer available on Google Play after reportedly exceeding one million downloads without ratings or reviews. It was unclear whether Google or the uploader removed the app.
Bitdefender identified thousands of deceptive Android apps abusing Google Play Early Access listings, which lack public ratings and reviews. The apps use social-media ads, including celebrity deepfakes, to lure users with false reward, gambling, utility, and trademark-themed offers while generating advertising revenue rather than delivering promised payouts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
5 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcexakep.ru
Open sourcethehackernews.com
Open sourcesecurityweek.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are exploiting demand for **Grand Theft Auto VI** with fraudulent websites that promise “VIP Early Access,” beta keys, and subscriptions while impersonating official branding with GTA 6 logos, Vice City imagery, and other convincing artwork. Researchers cited by Malwarebytes and NordVPN reported a surge in these sites, which primarily target **PC** and **Android** users by advertising nonexistent versions of the game even though Rockstar Games has announced launch plans for **PlayStation 5** and **Xbox Series X/S** and said there is **no public beta program**. Victims are typically asked to send about **$250** in cryptocurrency, including **Bitcoin**, **Ethereum**, or **USDT**, but receive neither access nor a legitimate game copy. Instead, the lures can lead to malware infections involving **information stealers**, **banking trojans**, **adware**, or **ransomware**, extending a pattern seen in earlier GTA 6-themed scams that used fake ads and bogus PC beta downloads to compromise users.
Jun 29, 2026
Check Point researchers identified an Android malware campaign, dubbed **AdultSwine**, embedded in roughly 60 game applications on **Google Play**, many of them designed for children. The infected apps were downloaded an estimated **3 million to 7 million times** and used a command-and-control infrastructure to upload device information, receive configuration updates, hide app icons, and trigger advertising behavior after device boot or screen unlock. The malware displayed intrusive ads outside the host app, including pornographic content, while deliberately avoiding overlays on browsers and social networking apps to reduce user suspicion. The campaign monetized infections through multiple fraud schemes, including fake virus alerts that pushed users toward dubious “security” apps and bogus prize offers such as an iPhone giveaway that harvested phone numbers for **premium-service subscription fraud**. Researchers warned that the same remotely controlled delivery mechanism could be adapted for broader social-engineering attacks or credential theft, highlighting the risk posed by malicious apps that bypass platform trust and reach large numbers of mobile users through official app stores.
Aug 14, 2026
ESET uncovered a large Android fraud campaign, tracked as **CallPhantom**, that used 28 apps on Google Play to falsely promise access to call histories, SMS records, and WhatsApp call logs for arbitrary phone numbers. The apps were downloaded more than **7.3 million** times, primarily by users in **India** and the wider **Asia-Pacific** region, before Google removed them after disclosure in December 2025. Instead of providing real communications data, the apps generated fabricated records from hardcoded values and displayed deceptive previews to convince users the service worked. The operation monetized victims through multiple payment channels, including **Google Play billing**, third-party **UPI** payment flows, and embedded card-entry forms, with the latter methods violating Google Play policy and making refunds harder to obtain. Researchers said some apps also used fake notifications to drive users back into subscription prompts, while backend infrastructure relied on **Firebase Cloud Messaging** for command-and-control and Firebase databases to manage some payment details. Published reporting also included indicators of compromise such as app **SHA-1 hashes**, Firebase domains, and related IP addresses tied to the campaign.
Jun 29, 2026