Experts from ESET found as many as eight fake apps in Google Play: they promised, among other things, to increase social media followers. Available in the store for over four months, the apps were downloaded nearly a million times. After reporting the issue, Google’s security team removed all malicious apps from its store.

Many friends, even more likes

Empty promises

The mentioned apps promised, among other things, the ability to add up to half a million new friends to a user’s Facebook profile and gain a similar number of “likes.” In reality, the main goal of the apps was to enroll users in paid SMS services, obtain their consent to receive newsletters, display ads, or collect their personal data.

Premium SMS, unwanted newsletters

How the scam worked

Each app operated in a similar way. After launching the app, users were asked to select their mobile device model from a displayed list and choose the number of friends they wanted to gain. After clicking the “start generating” button, users had the impression they were moving to the next step — data verification. However, the displayed form was actually used to collect data and gain consent to subscribe to an unwanted newsletter or activate a Premium SMS service. The latter option meant an additional charge on the user’s bill — a weekly subscription to the SMS service cost almost EUR 5 (USD 4.40).

Four safety rules

How to spot fake apps in Google Play?

Although all the fake apps had many low ratings and negative reviews, nearly a million users still installed them on their mobile devices. How to avoid falling into a similar trap? Kamil Sadkowski, an expert from ESET’s Kraków antivirus lab, provides four rules to always remember.

1. Check user reviews and ratings for the app. Focus on the negative ones — they are often from real users who describe the harmful behavior of the app.
2. Follow the rule: “It’s too good to be true” — if an app promises half a million followers for a single click, better skip installing it.
3. Think twice before submitting your private data in the app or giving consent to enable additional services, such as Premium SMS.
4. Use one of the security apps that protects your device from viruses or data theft.

Summary

Fake apps in Google Play promised quick acquisition of half a million friends and likes on Facebook, but in reality they enrolled users in paid Premium SMS services (a weekly subscription cost almost EUR 5), collected personal data, and showed ads. Despite numerous negative reviews and low ratings, nearly a million people installed these apps over four months. ESET expert Kamil Sadkowski advises: check reviews, follow the “too good to be true” rule, protect your private data, and use security apps.