Android users are being urged to think twice before downloading any new apps after security experts uncovered a large campaign involving thousands of fake applications designed to trick people into handing over money.
Researchers at McAfee spotted the surge in dodgy software, which all masquerade as official and hugely popular services, including CapCut, Roblox, Zelle, PayPal, Netflix, Xbox Game Pass, Siri and iMessage. This tactic is aimed at luring unsuspecting users into hitting the install button.
This is not the usual warning about malware or apps stealing personal information. Instead, the scammers are using a range of sneaky tactics to make money, including bombarding victims with endless adverts and attempting to sign them up to fraudulent third-party subscriptions. Those caught out could end up paying hefty monthly fees for services that simply don't exist.
Scale of the campaign
McAfee's Mobile Research Team says it has identified more than 1,900 unique applications linked to the campaign, spread across more than 500,000 devices in over 190 countries.
"Based on publication patterns, we estimate that the operators were releasing approximately 20 to 25 new applications per day, each leveraging different themes, brands, and impersonation targets," McAfee said.
Britain is also firmly in the firing line. McAfee's figures show streaming, TV and sports apps accounted for 17% of detections in the UK, making them the biggest category targeted. Video and photo editing apps came next, accounting for 13%.
Seven tips to avoid becoming a victim
Anyone concerned should think twice before installing any new software. To help avoid becoming a victim, McAfee has also issued seven important tips that are worth following.
First, only download financial apps through your bank's official website or a verified link. Searching an app store for a payment service could put you exactly where these scammers want you.
You should also be suspicious of apps described as guides, tutorials, helpers or tips for products you already use. Genuine services shouldn't need a separate application to explain how they work.
Another important step is to check the developer's name rather than simply trusting an app's branding, logo or title. Official software should be published by the company behind the service.
Red flags and security advice
It's also worth remembering that some products simply aren't available on Android. There is no official Apple Pay, Siri or iMessage app for Google's mobile platform, so any download claiming to offer these services should immediately raise alarm bells.
Don't assume an app is safe just because it has plenty of downloads, either. McAfee says several of the dodgy applications uncovered had already attracted tens of thousands of installs.
Finally, consider installing reputable mobile security software. McAfee says its own Mobile Security app can detect this family of threats.
"Mobile security has genuinely improved," McAfee said. "Attackers move to one part of the system that cannot be patched: the judgment of the person holding the phone. And they apply pressure exactly where that judgment is weakest — a familiar logo, an official store, a name that matches what you searched for."
"As threat actors continue to exploit trust rather than software vulnerabilities, McAfee remains committed to protecting users, raising awareness, and collaborating across the industry to ensure that seemingly harmless applications do not evolve into large-scale fraud operations."
