Bitdefender reports that Google Play’s “Early Access” apps can’t be publicly rated or reviewed, reducing a key warning signal employees use to spot deceptive apps. The research found thousands of suspicious Early Access apps (including fake casino/reward apps and utilities) promoted on social media, sometimes with AI-generated celebrity deepfakes. One example QR scanner tried to become the phone’s launcher, an unusual permission that could enable ad fraud or even fake login screens and interception of 2FA codes.
Google Play's Early Access program lets developers publish apps before they open to the general public. According to Bitdefender research, this stage carries a hidden downside: users cannot publicly rate or review an app while it remains in Early Access. That removes one of the most common signals employees use to judge whether an app is trustworthy.
Bitdefender Labs identified thousands of Early Access apps that appeared to include fake casino and reward games, misleading utilities, and apps using recognizable third-party trademarks. Many of these were promoted through TikTok, Facebook, and other social platforms, with some ads featuring AI-generated deepfakes of celebrities and other public figures to build false credibility.
One documented example involved a QR code scanner app that tried to persuade a user to replace the phone's official Android launcher. A basic QR scanner only needs camera access, so requesting launcher-level control is far beyond what the app's stated function requires.
The absence of public ratings and reviews during Early Access removes a layer of social proof that many users rely on, even subconsciously, before installing an app. Combined with polished social media promotion and celebrity-style endorsements, some of which may be AI-generated, these apps can appear more legitimate than they are. On personal or BYOD Android devices used for work, there is often no additional gatekeeping to catch what the app store review process might otherwise flag.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Early Access apps cannot be publicly rated or reviewed, which removes a common way users spot deceptive apps before installing them.
Bitdefender identified thousands of Early Access apps including fake casino and reward games, misleading utilities, and apps using recognizable third-party trademarks.
Many apps were promoted through TikTok, Facebook, and other social platforms, including ads featuring AI-generated deepfakes of celebrities and other public figures.
A QR scanner app tried to get users to set it as their phone's launcher, an unusual request that has no legitimate scanning purpose and could enable continuous background activity.
On Google Play, “Early Access” apps look legit, but you can’t see any public ratings or reviews. Bitdefender found thousands of sketchy Early Access apps, fake casino and reward games, and even a QR scanner that tried to replace the Android home screen. Some are pushed on TikTok and Facebook with AI-generated celebrity promos: “Install this Early Access rewards app to earn money and claim prizes.” No reviews, just hype. If any simple app, like a QR scanner or rewards game, asks for weird permissions or launcher access, especially in Early Access, don’t install it on your work phone. Stop there.
Researchers say criminals are abusing Google Play’s “Early Access” program to distribute deceptive apps that promise cash, rewards, or casino winnings. The apps are promoted through social media ads (including AI celebrity deepfakes) and use a “never-ending payout” loop to keep people watching ads…
Cofense reports multiple real-world campaigns where attackers don’t hack the browser, they trick employees by copying normal browser experiences like login pop-ups, software update prompts, and “verification” checks. The goal is to get users to enter credentials, approve attacker sessions, or run…
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Researchers reported a real malvertising campaign where ads on Meta platforms promoted a fake TV-streaming app to Spanish-speaking users, leading them to sideload an Android app. After victims approved a chain of permissions (including Accessibility), the StreamRat trojan could remotely control the…
Researchers uncovered a long-running “SEO poisoning” operation that manipulates Bing search results to push people onto fake support and activation pages. Victims are steered through a chain of redirects to either download a malware-laced ZIP (MayaBot) or be pressured into calling a fake…
