How do malicious app clones bypass app store moderation?
Cybercriminals slip counterfeit apps past automated security checks by uploading harmless initial code, offloading payloads after approval, and buying sponsored search ads.
Malicious app developers exploit vulnerabilities in automated app store moderation by submitting completely benign dropper applications that contain no harmful code during initial review. Once approved and published on platforms like the Google Play Store, these apps download malicious payloads through dynamic in-app updates or secondary class loaders. Attackers also purchase sponsored search ad slots to boost downloads before scanners detect anomalous behaviour. Advanced malware campaigns even abuse stolen attestation keys and compiled native system libraries to trick built-in security frameworks.
- Over 60 million
- Bitdefender Labs in a 2024 security report
- 100,000 downloads
- Security researchers and news reports in October 2024
- 500,000 downloads
- Play Store listing reports in October 2024
- 331 applications
- Bitdefender and IAS Threat Lab in 2024
- mParivahan and e-Challan
- Cyfirma research report on the NexusRoute campaign
What's happening now
In late 2024, counterfeit versions of widely used applications—including Google Chrome and WhatsApp—managed to gain prominent placement inside the Google Play Store, accumulating hundreds of thousands of downloads before being taken down. In the case of the fake Chrome app, attackers bought sponsored ad slots within Google Play search results. That placed the malicious listing above legitimate search results and tricked over 100,000 users into downloading it.
The incidents highlight a structural vulnerability in modern app store moderation. Automated scanners review code when an application is first submitted, but threat actors increasingly deploy multi-stage attack pipelines. Security researchers at Bitdefender identified an ad-fraud campaign involving at least 331 malicious applications hosted on the Google Play Store that amassed more than 60 million downloads. These apps initially mimicked simple utility tools such as QR scanners, wallpaper apps, and expense trackers while remaining completely benign during submission.
Meanwhile, sophisticated malware operations targeting Indian citizens have expanded rapidly. Cybersecurity firm Cyfirma uncovered an active campaign named NexusRoute that impersonated official Indian government services, including mParivahan and e-Challan. Distributed through GitHub Pages and fraudulent download portals, these clones deploy aggressive droppers designed to extract login details, intercept SMS messages, and execute unauthorized financial transactions.
To bypass stricter operating system controls on Android 13 and later, threat actors have turned to deeper evasion techniques. Dutch mobile security firm ThreatFabric revealed that a banking trojan named Hirudo actively replaces legitimate banking apps on infected devices. The malware uses leaked cryptographic attestation keyboxes to trick Google Play Integrity checks, ensuring altered apps return valid security responses.
How counterfeit apps sneak onto devices and evade moderation
Submitting a clean dropper application
Developers build a basic utility or lure app, such as a drama player or QR scanner, containing entirely legitimate code. Because static code analysis during app store submission detects no suspicious functions, automated moderation systems approve the listing.
Purchasing sponsored app store placement
To maximize immediate downloads, attackers purchase sponsored search ads directly on the app store platform. This pushes the fake application to the top of search results for popular brand names like Chrome or WhatsApp before user flags alert administrators.
Dynamically loading the malicious payload
Once installed on a user device, the application displays a fake in-app update prompt or uses dynamic class loaders such as DexClassLoader to fetch the real malicious code from external servers, bypassing pre-installation checks.
Hiding logic in compiled native libraries
Attackers move critical execution logic into compiled C and C++ native libraries loaded via Java Native Interface. Moving logic into native code obfuscates malicious operations from standard reverse-engineering and security tools.
Manipulating integrity checks and network traffic
Advanced malware configures non-functional VPN connections to suppress cloud reputation checks by security tools like Google Play Protect. It also relays integrity attestation requests to attacker servers using leaked cryptographic keys to mimic valid app signatures.
Who it affects
In India, millions of smartphone users who rely on digital public infrastructure are prime targets for counterfeit applications. The NexusRoute campaign specifically targeted citizens seeking traffic fine management and vehicle registration services by spoofing the Ministry of Road Transport and Highways' official mParivahan and e-Challan portals. These malicious clones harvested personal credentials, contact lists, call logs, and SMS messages required for two-factor banking authentication.
Financial app users across emerging and established digital markets face heightened risks from targeted banking trojans. ThreatFabric's analysis of the Hirudo malware demonstrated active credential targeting across India, Indonesia, China, Mexico, Morocco, and Thailand. By deploying malicious replacements for legitimate banking software, attackers gain direct access to payment PINs, screen overlays, and live device control.
On a global scale, ad fraud and credential harvesting campaigns affect tens of millions of Android users regardless of technical literacy. Bitdefender's investigation showed that over 60 million users downloaded ad-serving malware disguised as everyday utility tools, exposing them to persistent full-screen advertisements, out-of-context phishing prompts, and credit card theft.
What's being done, and is it working
Institution
Google
Operates Google Play Protect and automated Play Store scanning tools, regularly purging identified malicious listings and suspending developer accounts.
Community
ThreatFabric and cybersecurity research firms
Conduct active telemetry analysis and reverse engineering on emerging Android malware families to expose dynamic loading mechanisms and attestation bypasses.
Institution
Indian Computer Emergency Response Team (CERT-In) and Cyfirma
Track national phishing campaigns targeting public utility infrastructure like mParivahan and issue technical advisories to dismantle malicious GitHub repositories.
Market
Third-party mobile security developers
Deploy post-installation behaviour monitoring technologies, such as App Anomaly Detection, to observe app activity after installation.
What you can do
Verify developer names and download counts on the app store listing before installing any popular application.
Avoid clicking sponsored ad links inside store search results, relying instead on official developer links from verified websites.
Check app permissions during and after installation, revoking unnecessary access to accessibility services, SMS, and overlay permissions.
Ensure Google Play Protect is enabled on your device and set to perform periodic security scans.
Inspect mobile banking apps for unexpected login interface changes or unusual requests for manual system updates.
What we still don't know
- How effectively can automated store moderation catch dynamic payload loading when code execution is delayed until days after installation?
- What structural changes will app store operators implement to prevent malicious actors from purchasing sponsored search ads for protected brand keywords?
- Will hardware-backed cryptographic attestation fully prevent malware from using leaked keyboxes to spoof system integrity responses?
Questions readers ask
How do fake apps get into the top search results on official app stores?
Attackers purchase sponsored ad placements for popular keywords inside the app store. This pushes their listing above legitimate search results before automated detection systems or user flags identify the app as malicious.
Why don't automated security scanners detect malicious code during app review?
During initial submission, the application contains no malicious code. The harmful functionality is downloaded later from remote servers through secondary in-app updates or dynamic code loaders after the app is approved and published.
Can Google Play Protect stop apps from downloading malicious updates later?
Google Play Protect performs offline and cloud security scans, but attackers use evasion methods such as native library obfuscation and deliberately non-functional VPN configurations to suppress cloud reputation checks.
