Fraud Network with More than 7 Million Downloads on Google Play Busted
CallPhantom fraudulent applications, which were downloaded 7.3 million times on Google Play with the promise of accessing other people’s call and message records, were detected.
A new fraud method that can be downloaded from the Google Play Store and targets users has come to light. ESET researchers found that 28 different applications that promised access to others’ private communication records were downloaded more than 7.3 million times in total.
These applications, called CallPhantom, claimed that users could access SMS, call history and WhatsApp records by entering their phone number. However, it was determined that these software had no real access authority and were deceiving users with fake data.
Working Principle of CallPhantom Applications
Researchers state that although these applications have different interfaces, they use the same method. After entering a phone number, users are forced to pay to open the so-called records and in return receive fake data generated by the system.
Some apps use random name and call details pre-embedded in the code, while others require an email address to which the data will be sent. ESET emphasizes that these applications do not ask for any hidden permissions and do not actually have the capacity to access the targeted data.
Fraudulent payment methods pose additional risks for users. While some apps use Google Play’s official payment system, others redirect users to third-party payment platforms or forms that directly request credit card information.
Google Interference and Security Alerts
Some of the apps show fake email notifications when users try to log out, giving misleading warnings that the results have been delivered. These notifications aim to encourage users to make payments by directing them back to the subscription screen.
ESET reported the 28 applications in question to Google on December 16, and all applications were removed from the store at the time the report was published. This situation once again reveals that malware that can evade the security controls of the Google Play Store can reach large audiences.
When downloading applications from Google Play, you need to be careful, especially against software that promises to violate the privacy of personal data.
Do you think the audit processes in application stores are effective enough against such fraud attempts?
