Researchers at McAfee Labs have uncovered a large-scale fraudulent app campaign operating through the official Google Play Store, identifying more than 1,900 fake versions of popular applications across 500,000 devices in over 190 countries prior to their removal by Google.

The UK emerged as one of the most heavily targeted markets globally, recording 11,862 detections across 10,582 protected devices and making it the eighth most affected country worldwide. British detections accounted for nearly 2% of total global activity, with security experts identifying 970 fake applications specifically aimed at consumers in the UK.

Scammers strategically tailored their offerings to align with what UK users search for most frequently. Streaming, TV and sports apps accounted for 17% of local detections, followed by video and photo editors at 13% and gaming applications at 11%.

The fraudulent software impersonated well-known services and brands, including Netflix, PayPal, Clash of Clans, Roblox, Xbox Game Pass, CapCut, and Apple tools – utilising familiar logos to trick unsuspecting users.

Rather than delivering the promised functionalities, the malicious apps redirected users into aggressive advertising funnels and fraudulent subscription schemes charging up to $49.99 per month.

The findings illustrate a growing trend in cybercrime where threat actors exploit consumer trust in established brands and official app marketplaces instead of relying on complex technical exploits.

How to protect yourself

• Install financial apps only from your bank’s own website or a verified link. If you are searching for an app store for a payment brand, you are in the exact position this campaign targets.
• Be suspicious of “guide,” “tutorial,” “helper” and “tips” apps for products you already use.
• Legitimate services do not need a third party to explain them.
• Check the developer’s name, not just the app name and icon. A real brand’s app is published by that brand.
• If a product doesn’t exist on your platform, no app can provide it. There is no Apple Pay, Siri, or iMessage for Android.
• Ignore install counts as a trust signal. Several of these apps had tens of thousands of downloads.
• Run mobile security software.

For latest tech stories go to TechDigest.tv