- Bitdefender finds Google Play Early Access platform could give malicious apps an easy breeding ground
- User reviews and ratings are not publicly displayed, removing the ability for users to evaluate if an app is legitimate
- Games, casinos, and utility apps are being loaded with malicious packages and downloaded thousands of times
Google has unveiled an Early Access program for the Play Store, allowing developers to list early-access apps for testing and feedback.
While great for smaller apps looking to weed out any wrinkles in their apps, Early Access also offers a lucrative way for malicious actors to lure users into downloading apps that look legitimate, but can hide malicious packages inside.
However, new research from Bitdefender notes the fact that the Early Access program hides public reviews and ratings could lead to an app ecosystem filled with scams, fake casinos, and malware-laden packages masquerading as legitimate software.
Early Access is filled with dangerous apps
When looking for apps on the normal Play Store, one of the first things users are greeted with is an app’s rating. For fake or malicious apps, users can quickly evaluate whether or not to download the app thanks to the star rating and user reviews. While there is the potential for nefarious developers to fake reviews and ratings there is at least some ability to check if an app is legitimate.But the Early Access system does away with public user ratings and reviews entirely. There is effectively no way for users who fall victim to a fake app to publicly warn other users not to download the app.
Add to this equation that ability for developers to show off their apps through sponsored Facebook and TikTok videos, offering outrageous rewards or using deepfakes of celebrities to entice users to install their apps.
This is especially true for fake gambling apps. Bitdefender has spotted numerous adverts for casino apps using deepfakes of well known celebrities such as Cristiano Ronaldo, Jason Statham, and Andrew Tate. These apps actively push users into the Google Play Early Access store, or direct to the apps website.
When detected as illegitimate, these scam apps will often be deleted before being replaced by exact copies that perform the same malicious functions. Some illegitimate apps have been downloaded thousands of times, Bitdefender said, but many remain available on the Google Play Early Access store.
But the scam apps aren’t limited to games and casino apps. Bitdefender also saw numerous apps offering utility functions such as QR code scanners or PDF readers. In some circumstances, the exact same apps were listed multiple times by different developers - likely to expand the reach and maximize the number of downloads.
Bitdefender notes that Google Play’s reputation relies on users being able to trust the apps they are downloading, but the Early Access program removes almost every way users can detect a malicious app before installing.
Benedict provides detailed analysis on state-sponsored threat actors, APT groups, and the protection of critical national infrastructure, with his reporting bridging the gap between technical threat intelligence and B2B security strategy.
Benedict holds an MA (Distinction) in Security, Intelligence, and Diplomacy from the University of Buckingham Centre for Security and Intelligence Studies (BUCSIS), with his specialization providing him with a robust academic framework for deconstructing complex international conflicts and intelligence operations, and the ability to translate intricate security data into actionable insights.