A Google Play app originally listed as a game rebranded itself as Google Chrome and reportedly accumulated more than 100,000 downloads. It copied Chrome’s name, icon, and store screenshots, and was reportedly shown in a sponsored search placement above the real Chrome app. The case shows that employees should verify an app’s publisher and application ID, not just its logo, download count, or placement in an app store.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The top Google Play result for Chrome wasn’t Chrome. A game called Ball Bounce changed its name and icon to Google Chrome. Its listing copied Chrome’s screenshots and reportedly appeared as a sponsored result above the real app. Here’s the tell: the publisher was Hizbartech, not Google LLC. The app ID still said com.ballbounce.Hizbartech, not com.android.chrome. A logo and top placement prove nothing. The copycat was removed; malware wasn’t established. Before installing, open Google’s official site and follow its Chrome app link.
A phishing campaign targets YouTube creators with a fake, invite-only Amazon Music advertising deal. The fraudulent site uses each creator’s real public channel statistics to appear legitimate, then places a fake Google sign-in screen over the page to capture Google passwords and multi-factor…
Cybercriminals impersonated well-known technology brands including Claude, Google, Apple, and Docusign to steal credentials, payment details, or gain access to devices. The lures used urgent payment failures, software-update prompts, and promised device-performance improvements to persuade people…
Microsoft says it uncovered and disrupted an underground marketplace (“YAM Store”) that sold phishing kits and access to cloud accounts, enabling massive global phishing and SMS scam campaigns. The operation allegedly supported over a billion scam messages since January 2026 and targeted 75,000+…
Scammers are targeting YouTube creators with personalized “sponsorship” emails that lead to a convincing fake collaboration website. The site pulls public channel data, then asks the creator to “Sign in with Google” to “verify” the channel, stealing the password and one-time code to take over Gmail…
A recent scam targets YouTube creators with personalized “paid collaboration” emails that impersonate well-known brands and push victims to a fake collaboration platform. The site then routes victims to a Google sign-in step that can capture credentials or trick users into granting dangerous…
Researchers reported an Iranian state-aligned actor impersonating the Dubai Airports IT department to lure a targeted Iraqi individual into installing a fake “careers portal” and then opening a weaponized coding test. The workflow looked like a real recruitment process (HR questions, then a…
