Product

Google Play

4 mentions in 7 days · 4 in 30 days · 4 total · first seen Sep 10, 2026 · last 4d ago

Timeline4 articles

Google’s Early Access is creating a blind spot for malicious apps

Bitdefender found thousands of Google Play Early Access apps with deceptive behavior, including ad-fraud-capable utilities requesting excessive permissions on Android devices.

Bitdefender Labs analyzed Google Play apps installed by its users and identified thousands of Early Access applications that appeared deceptive, including fake casino and reward games, misleading utilities, and apps using third-party trademarks, many promoted via social ads with AI deepfakes. Early Access apps cannot receive public reviews, removing a key warning signal users normally rely on. Some apps requested unusual permissions, such as a QR scanner seeking to replace the device launcher, which could enable hidden web views that click ads and potentially display fake login screens or capture two-factor codes. Bitdefender recommends Android Enterprise Work Profiles and notes Google Workspace admins can disable Early Access apps for their organization.

CSO Onlineupdated Sep 11, 12:14 UTC · 4d agofirst Sep 11, 08:36 UTC · 4d agoMalware 6 sources

New Android malware encrypts files, steals data, and harasses victims

Zimperium details Mantax Otax, an Android malware combining ransomware, spyware, and harassment, spread via phishing APKs to Indonesian users.

Zimperium researchers report Mantax Otax is distributed through malicious APKs hosted outside Google Play via phishing and social engineering, then abuses Accessibility permissions for broad device control. It encrypts files with a C2-provided AES key on Android 9 and older, adds '.enc' extensions, and hosts ransom chats on Firebase; researchers exposed attacker chats via a Firebase misconfiguration. The malware steals lock-screen PINs, SMS one-time codes, contacts, WhatsApp and Telegram chats, and captures screens via MediaProjection, while version 2 adds jumpscare overlays and text-to-speech harassment. Google Play Protect already detects and blocks it on up-to-date devices via the App Defense Alliance.

BleepingComputerupdated Sep 11, 12:14 UTC · 4d agofirst Sep 10, 21:40 UTC · 5d agoMalware in the wild 6 sources

Google Play Early Access Abused to Push Thousands of Deceptive Android Apps

Bitdefender found abuse of Google Play's review-free Early Access program to push thousands of deceptive casino and reward apps promoted with AI deepfake ads.

Bitdefender reports threat actors are abusing Google Play's Early Access program, which blocks public reviews and ratings, to distribute thousands of deceptive casino, reward, and utility apps. A GTA imitator, 'Vice Streets: Open World,' surpassed 1 million downloads before disappearing, with apps promoted via AI celebrity deepfake ads on TikTok and Facebook and monetized through endless ad serving and payouts that never arrive. The report coincides with disclosures on Android malware families Hagaseca, Mantax Otax, StreamRat, and GoldFactory's Gigabud banking trojan with its Vwork companion app used for cloned-app financial fraud.

The Hacker Newsupdated Sep 11, 12:14 UTC · 4d agofirst Sep 10, 14:36 UTC · 5d agoPhishing & fraud in the wild 6 sources

Deceptive Android Apps Exploit Google Play Early Access to Evade Reviews

Bitdefender reports deceptive Google Play Early Access apps use deepfake celebrity ads and fake rewards to lure users into ad-fraud schemes.

Bitdefender research describes widespread abuse of Google Play's Early Access program, where developers publish deceptive apps that avoid public ratings and reviews. The apps are promoted through TikTok and Facebook ads promising cash rewards, PayPal payouts, crypto earnings, or gift cards, often using deepfakes of celebrities, but users receive only aggressive advertising. Examples include 'Chicken Road' and 'Ice Fishing' casino-style games plus trademark abuse such as apps named 'Grand Theft Auto V (Early Access)' that are later renamed. No malware is delivered, but some listings show thousands of installs.

SecurityWeekupdated Sep 11, 12:14 UTC · 4d agofirst Sep 10, 13:39 UTC · 5d agoPhishing & fraud in the wild 6 sources

Appears with

vendor Google 4 vendor Bitdefender 3 organization Bitdefender 2 organization Google 2 malware Mantax Otax 2 organization Group-IB 1 product Android 1 product Chicken Road 1 product Firebase 1 product Ice Fishing 1 product Play Protect 1 threat actor GoldFactory 1 vendor Zimperium 1 malware Gigabud 1 malware Hagaseca 1 malware StreamRat 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.