28 Fake Call History Apps Hit 7.3M Play Store Downloads
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- ESET discovered 28 fraudulent apps on Google Play Store codenamed CallPhantom that collectively amassed over 7.3 million downloads, with one app alone exceeding 3 million, before being taken down.
- The apps promised access to call histories, SMS records, and WhatsApp call logs for any phone number but contained no actual data-retrieval functionality and never requested sensitive permissions, instead serving randomly generated names and numbers hardcoded into the source code.
- The campaign primarily targeted Android users in India and the broader Asia-Pacific region and has been active since at least November 2025, with at least one app published under the developer name "Indian gov.in" to manufacture user trust.
- Subscription prices ranged from approximately $6 to $80, with payments routed through Google Play billing, India's Unified Payments Interface apps including Google Pay, PhonePe, and Paytm, or direct payment-card checkout forms—the latter two methods violating Google policy.
- One app variant displayed a deceptive post-exit notification claiming a call history had been emailed to the user, redirecting clicks directly to a subscription screen to extract payment.
- ESET researcher Lukáš Štefanko noted that Google Play billing subscribers may qualify for refunds, but purchases made via third-party UPI apps or direct card entry cannot be refunded by Google, leaving victims dependent on external payment providers or developers.
Why it matters: Seven million-plus downloads on Google's official Android storefront—using fake government branding and a zero-permission app shell that needed no malware to function—shows platform-side vetting failed to catch a scam that relied entirely on social engineering. With subscriptions priced up to $80 and two-thirds of payments routed through channels Google cannot refund, millions of users in India and Asia-Pacific absorbed direct financial loss with limited recourse.
Ask SkimNews
