Fake Call History Apps Scammed Users After 7.3 Million Google Play Downloads
Summary
ESET says 28 CallPhantom Android apps on Google Play drew over 7.3 million downloads by promising call, SMS and WhatsApp histories, then charging users for fabricated data. The apps were removed; Group-IB separately reported fraud targeting Indonesians.
Key points
- ESET identified 28 CallPhantom apps on Google Play with more than 7.3 million combined downloads before removal; one app had over 3 million downloads.
- The apps claimed to reveal call, SMS and WhatsApp histories for any number, but supplied fabricated data after users paid.
- Payment methods included Google Play subscriptions, third-party apps supporting UPI and in-app card forms; plans ranged from about $6 to $80.
- Some apps used the developer name “Indian gov.in” to appear trustworthy; at least one used a deceptive notification to direct users to a subscription screen.
- ESET said subscriptions should have been canceled after removal; refunds may be available for Google Play billing, while other payments depend on external providers or developers.
- Group-IB separately estimated that a campaign linked to GoldFactory stole $2 million from Indonesian users using phishing, WhatsApp social engineering, sideloaded APKs and voice phishing; reported malware included Gigabud RAT, MMRat and Taotie.
Article Details
- Event Type
- Discovery of fraudulent Android apps that misrepresented access to phone call and message histories and used deceptive payment and subscription tactics.
- Impact
- ESET reported that 28 CallPhantom apps accumulated more than 7.3 million Google Play downloads before removal; users who paid received fabricated data, and the source does not quantify CallPhantom victims' financial losses. Separately, Group-IB estimated that a fraud campaign linked to GoldFactory stole $2 million from Indonesian users.
People
Threat Actors
Malware
Gigabud RATGroup-IB reported a separate fraud campaign tied to GoldFactory, Gigabud RAT, MMRat, and Taotie in Indonesia.MMRatGroup-IB reported a separate fraud campaign tied to GoldFactory, Gigabud RAT, MMRat, and Taotie in Indonesia.TaotieGroup-IB reported a separate fraud campaign tied to GoldFactory, Gigabud RAT, MMRat, and Taotie in Indonesia.
Products
AndroidResearchers uncovered 28 fraudulent Android apps on Google Play that claimed to provide call, SMS, and WhatsApp history for any phone number, but instead charged users for fake data and financial loss.CoreTaxfrom Indonesian users as part of a fraud campaign that involved posing as the country’s tax platform, CoreTax, and other trusted brands.Google PayIronically, this list includes Google Pay, Walmart-backed PhonePe, and Paytm.Google PlayResearchers uncovered 28 fraudulent Android apps on Google Play that claimed to provide call, SMS, and WhatsApp history for any phone number, but instead charged users for fake data and financial loss.PaytmIronically, this list includes Google Pay, Walmart-backed PhonePe, and Paytm.PhonePeIronically, this list includes Google Pay, Walmart-backed PhonePe, and Paytm.WhatsAppResearchers uncovered 28 fraudulent Android apps on Google Play that claimed to provide call, SMS, and WhatsApp history for any phone number, but instead charged users for fake data and financial loss.
Countries
IndiaThe campaign, named CallPhantom, targeted Android users in India and the Asia-Pacific region and used deceptive developers, subscription traps, and payment methods to mislead victims.IndonesiaGroup-IB reported a separate fraud campaign tied to GoldFactory, Gigabud RAT, MMRat, and Taotie in Indonesia.