Fake Call History Apps Steal Payments After Millions of Play Store Downloads

The Hacker News reports a significant mobile fraud campaign involving 28 malicious apps on the official Google Play Store. These apps, collectively downloaded over 7.3 million times, masqueraded as tools to access call histories for any phone number. This functionality, predictably, was fake.

Instead of providing data, the apps tricked users into recurring subscriptions that delivered no legitimate service, directly leading to financial loss for victims. This is a classic bait-and-switch, leveraging user curiosity and a perceived utility to bypass Google’s vetting processes and monetize through fraudulent subscriptions.

This incident underscores a persistent challenge: even official app stores remain vulnerable to sophisticated social engineering and abuse. Defenders must recognize that app store presence does not equate to security. The attacker’s calculus here is simple: volume and plausible deniability. With millions of downloads, even a small conversion rate yields substantial illicit gains, and the apps’ initial appearance of legitimate utility helps them evade detection for extended periods.