Sunday, March 30, 2025
HomeAndroidMalicious Fleeceware apps on the Google Play Found Installed More than 600...

Malicious Fleeceware apps on the Google Play Found Installed More than 600 Million Downloads

Published on

SIEM as a Service

Follow Us on Google News

Fleeceware apps continue to be a problem on Google Play, these app publishers overcharge users for basic functionality if they don’t cancel the subscription before the trial ends.

The app publishers take advantage of the business model in which user downloads and use the app for a short trial period for no charge.

If the user fails to uninstall the app and inform the developer that they are not interested at the end of the short trial period, then the app developers charge the users.

Fleeceware on Google Play

Sophos observed several Fleeceware apps on Google play store that cause monetary damage to users. these apps found to be installed more than 600 million times in total.

Fleeceware apps
Fleeceware Apps found

Also, some of the apps such as keyboard apps allegedly transfer the text typed by the users to the servers located in China.

The apps associated with categories such as entertainment or utility apps, including fortune-tellers, instant messengers, video editors, and beauty apps.

Several users complain that even after following the subscription rules, they have been charged by the app developers.

Some of the apps mimic the original apps in the design and other features, but there is a difference in the subscription.

Fleeceware apps
Mimic the original App

The bad news is that some of the apps on the play store claim they have “1 million, 5 million, 10 million, or even 100 million installs.”

Researchers believe these app developers may use some paid services to reach the users. Also, they use to add fake reviews.

A high number of reviews and installs let the apps appear at the top of the list and attract the users.

A full list of the apps and download counts can be found here. Sophos has reported malicious apps to the Google Play Store.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Gamaredon Hackers Weaponize LNK Files to Deliver Remcos Backdoor

Cisco Talos has uncovered an ongoing cyber campaign by the Gamaredon threat actor group,...

“Crocodilus” A New Malware Targeting Android Devices for Full Takeover

Researchers have uncovered a dangerous new mobile banking Trojan dubbed Crocodilus actively targeting financial...

SquareX Discloses Browser-Native Ransomware that Puts Millions at Risk

From WannaCry to the MGM Resorts Hack, ransomware remains one of the most damaging...

Hackers Exploit DNS MX Records to Create Fake Logins Imitating 100+ Brands

Cybersecurity researchers have discovered a sophisticated phishing-as-a-service (PhaaS) platform, dubbed "Morphing Meerkat," that leverages...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

“Crocodilus” A New Malware Targeting Android Devices for Full Takeover

Researchers have uncovered a dangerous new mobile banking Trojan dubbed Crocodilus actively targeting financial...

Hackers Exploit DNS MX Records to Create Fake Logins Imitating 100+ Brands

Cybersecurity researchers have discovered a sophisticated phishing-as-a-service (PhaaS) platform, dubbed "Morphing Meerkat," that leverages...

New Python-Based Discord RAT Targets Users to Steal Login Credentials

A recently identified Remote Access Trojan (RAT) has raised alarms within the cybersecurity community...