Android users are once again being urged to be careful about what they download onto their devices. This latest warning has been issued by McAfee security experts, who have spotted a surge in fake applications popping up across the web. Most of the dodgy apps look just like official software, with cyber crooks using famous names such as CapCut, Roblox, Zelle, PayPal, Netflix, Xbox Game Pass, Siri and iMessage to entice unsuspecting Android users into tapping the install button.
This isn’t your usual warning about malware or data-stealing bugs, as the attack uses different methods to make scammers money. Once downloaded, the fake software uses sneaky tricks including showing endless adverts and also trying to sign people up to third-party subscription-fraud. Being duped could leave some paying high monthly prices for services that aren’t real.
McAfee’s Mobile Research Team says it has identified more than 1,900 unique applications associated with the campaign across over 500,000 devices in more than 190 countries.
“Based on publication patterns, we estimate that the operators were releasing approximately 20 to 25 new applications per day, each leveraging different themes, brands, and impersonation targets,” McAfee said.
Those in Britain need to be on high alert as well. In the United Kingdom, streaming, TV, and sports apps led at 17 percent of detections, followed by video and photo editors at 13 percent.
In a bid to help Android users stay safe, McAfee has issued advice on how to stay safe with 7 tips all users should follow.
McAfee says only download financial apps from your bank’s official website or a verified link. If you are searching an app store for a payment brand, you could be in exactly the position this campaign is targeting. Be wary of “guide”, “tutorial”, “helper” and “tips” apps for products you already use, as legitimate services should not need a third-party app to explain how they work.
Always check the developer’s name, not just the app’s name and icon, as a genuine app should be published by the brand itself. Remember, if a product does not exist on your platform, no app can provide it. There is no Apple Pay, Siri or iMessage for Android. Do not trust download numbers as a sign of safety, as several of these apps had tens of thousands of installs. Finally, use mobile security software, with McAfee Mobile Security able to detect this family of threats.
“Mobile security has genuinely improved,” McAfee said
“Attackers move to one part of the system that cannot be patched: the judgment of the person holding the phone. And they apply pressure exactly where that judgment is weakest — a familiar logo, an official store, a name that matches what you searched for.
“As threat actors continue to exploit trust rather than software vulnerabilities, McAfee remains committed to protecting users, raising awareness, and collaborating across the industry to ensure that seemingly harmless applications do not evolve into large-scale fraud operations.”
