Fake Apps, Real Losses: How Deceptive Mobile Campaigns Target Banking Data
A banking app can look convincing, arrive through a familiar-looking store page, and still be part of a fraud campaign. Recent investigations show criminals combining deceptive advertisements, counterfeit app pages, and malicious or imitation apps to persuade people to reveal financial information. Some harmful apps have appeared in official app stores; other campaigns use ads to lead users to fake pages that only imitate those stores. These are related tactics, but not the same routeāand knowing the difference helps explain why a store badge alone cannot guarantee safety.
Ā
How the campaigns work
In March 2025, Bitdefender reported at least 331 malicious apps in Google Play tied to a large advertising-fraud campaign. Together, the apps had more than 60 million downloads. They posed as ordinary tools, including QR scanners, expense trackers, health apps, and wallpaper apps. Once installed, some hid their icons, launched without an obvious user action, and displayed intrusive full-screen ads. Researchers also found phishing screens that tried to collect account credentials and credit-card details. Some apps had first appeared harmless and later received versions with malicious behavior. At the time of the investigation, 15 apps in the campaign were still available in the store.1
Ā
Ā
A separate ESET investigation shows how misleading ads can steer users toward an app that was never downloaded from the official store, even when its page looks authentic. In a campaign targeting customers of a Czech bank, criminals placed ads on Facebook and Instagram. Some promised a reward; others claimed that a critical banking-app update was available. The ads led to pages imitating Google Play or the bankās own site, where victims were prompted to install a fake banking app.2
Ā
On Android, some of these pages used WebAPK technology to make a website-based phishing app appear more like a regular app. The fake app then asked for internet-banking credentials and sent the submitted information to servers controlled by the attackers. ESET also observed phishing apps delivered as progressive web apps on Android and iOS. The key deception was not simply a copied logo: it was the convincing sequence from advertisement, to imitation store page, to an installation prompt, to a fake login screen.2
Ā
Ā
The distinction between a malicious app and a fraudulent financial app is also important. Group-IB documented fake trading platforms found in both Google Play and Appleās App Store. Those apps posed as legitimate investment services and helped criminals solicit identity documents, personal details, and deposits. The first identified iOS app remained in the App Store for several weeks before removal; the operators later used phishing websites to distribute related apps.3Ā That case involved investment fraud rather than the same credential-stealing mechanism described by ESET and Bitdefender, but it demonstrates how store availability can be exploited to borrow a platformās credibility.
Ā
Why the deception succeeds
Scam ads often create urgency: āupdate now,ā āclaim a limited offer,ā or āsecure your account.ā Familiar logos and store-like layouts make those messages feel routine. A victim may believe they are responding to a bankās request, not installing software from a page controlled by criminals. When the app opens, a copied sign-in screen can capture a username, password, card number, or other personal information.
Ā
Some mobile malware can go beyond a fake login. Depending on the app and permissions it obtains, a banking trojan may overlay a counterfeit screen on top of a genuine banking app, monitor interactions, or intercept messages. The capabilities vary by campaign. Not every deceptive app has these features, and not every app-store listing is malware; some are designed primarily to trick people into sending money or personal data.1Ā 2Ā 3
Ā
Official stores still matter because review systems can block or remove harmful submissions, but they are not a promise that every listing is safe. An app may evade review, change behavior in a later update, or be used as the first step in a scam that moves the victim to a website. Apple reported that its review team evaluated more than 9.1 million submissions in 2025 and rejected more than 2 million for guideline violations; it also said it removed nearly 59,000 apps for bait-and-switch behavior.4Ā Those figures are Appleās own reporting, but they underscore the scale of review and the fact that enforcement is ongoing.
Ā
What users can do
Install a bankās app by following the link from the bankās official website or by searching the store and carefully checking the developer name. Do not install an āurgent updateā from an ad, message, QR code, or pop-up. If a promotion or security warning looks important, close the page and contact the bank using a phone number or web address you already know to be genuine.
Ā
Check whether an appās requested access fits its purpose. A simple utility that asks for access to SMS, accessibility controls, or other sensitive functions deserves extra scrutiny. Read recent reviews for patterns of complaints, but do not treat ratings as proof: reviews can be manipulated. Keep the operating system and apps updated, and remove unfamiliar apps or ones that behave unexpectedly. If you entered banking details into a page or app you now suspect, contact your bank promptly through a trusted channel, secure the account from a separate trusted device, and follow the bankās instructions.1Ā 2
Ā
Closing Thoughts
The central lesson is simple: trust should come from a verified route, not from a familiar icon, polished advertisement, or store-like screen. Criminals are exploiting the handoff between advertising, search, installation, and login. Each step can look ordinary on its own, which makes the full chain harder to recognize while it is happening.
Ā
What is the true implication of this?
The risk reaches beyond the phone. Stolen credentials can enable account takeovers, unauthorized transfers, identity fraud, and follow-on scams against a victimās contacts. When convincing fake apps circulate beside legitimate software, people may also lose confidence in digital banking and app stores. Reducing that harm requires both careful user habits and rapid action by platforms, advertisers, banks, and security researchers when a campaign is reported.
Ā
How does this impact us?
For everyday users, a single hurried tap can expose information that is difficult to replace: account access, card details, identity documents, or one-time passcodes. A short pause before installing an app or entering credentials can interrupt the scam. Verify updates through the bankās own channel, reject pressure to act immediately, and contact the bank quickly if anything seems wrong. These steps cannot eliminate every threat, but they can make a deceptive app much less likely to become a financial loss.
References
Comments