Deceptive Android Apps Exploit Google Play Early Access to Reach Mobile Users

Key facts

Detection coverage

As of 2026-09-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2655 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Deceptive Google Play Early Access App Installed or Listing Visited (Exploitation)

Detects installation of campaign-linked deceptive Google Play Early Access apps on managed Android devices, or user navigation to their Play listings. The IOC package com.gamblechaos.withfriends.game (apps 'Vice Streets: Open World' / 'Chaos With Friends' by developer STOCK AGE INTERNATIONAL) accumulated over 1,000,000 installs with zero public reviews; lure titles 'Chicken Road', 'Ice Fishing' and trademark-impersonating 'Grand Theft Auto V (Early Access)' clones follow the same bulk-production pattern. Installation is the initial-access event (user execution of the lure).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1566.002, T1608.001
• Data sources: zimperium_mtd, intune_managed_apps, web_proxy
• Severity: high
• Confidence: high

Splunk SPL

index=mtz sourcetype='zimperium:alerts' OR index=mdm sourcetype='intune:managedapps'
| search (package_name='com.gamblechaos.withfriends.game') OR (app_name IN ('Vice Streets: Open World','Chaos With Friends','Chicken Road','Ice Fishing','Grand Theft Auto V (Early Access)'))
| eval ioc_type=if(package_name='com.gamblechaos.withfriends.game','package',if(match(lower(app_name),'vice streets|chaos with friends|chicken road|ice fishing|grand theft auto'),'masqueraded_app_name',null()))
| where isnotnull(ioc_type)
| stats count min(_time) as first_seen max(_time) as last_seen dc(device_id) as devices by package_name app_name ioc_type
| append [search index=proxy sourcetype='proxy:web' url='*store/apps/details*' uri_query='*id=com.gamblechaos.withfriends.game*'
    | eval ioc_type='play_listing_url' | stats count min(_time) as first_seen max(_time) as last_seen by url ioc_type]
| table first_seen last_seen count package_name app_name devices url ioc_type

Microsoft KQL

let iocPackages = dynamic(["com.gamblechaos.withfriends.game"]);
let iocApps = dynamic(["Vice Streets: Open World","Chaos With Friends","Chicken Road","Ice Fishing","Grand Theft Auto V (Early Access)"]);
DeviceEvents
| where Timestamp > ago(30d)
| where DeviceType in ("AndroidPhone","AndroidTablet")
| where ActionType == "AppInstalled"
| extend package = tostring(AdditionalFields.PackageName), app = tostring(AdditionalFields.AppName)
| where isnotempty(package) or isnotempty(app)
| where package in (iocPackages) or app in (iocApps)
| project Timestamp, DeviceName, DeviceType, package, app

Sigma

title: Deceptive Google Play Early Access App Installed or Listing Visited
id: c4f3b1a9-2d5e-4f7a-9b3c-2655a01f0001
status: experimental
description: Detects installation of deceptive Google Play Early Access apps tied to the campaign IOC package com.gamblechaos.withfriends.game (Vice Streets: Open World / Chaos With Friends by developer STOCK AGE INTERNATIONAL) and the lure titles Chicken Road, Ice Fishing and Grand Theft Auto V (Early Access) on managed Android devices, or navigation to their Play listing URL.
references:
    - https://zimperium.com/blog/mobile-threat-watch/deceptive-apps-exploit-google-play-early-access-to-reach-mobile-users
    - https://www.bitdefender.com/en-us/blog/hotforsecurity/google-play-early-access-exploit-deceptive-apps
author: Threadlinqs Team
date: 2026/09/25
tags:
    - attack.execution
    - attack.t1204.002
    - attack.initial_access
    - attack.t1566.002
    - attack.resource_development
    - attack.t1608.001
logsource:
    product: android
    service: mtd
detection:
    selection_package:
        package: 'com.gamblechaos.withfriends.game'
    selection_app:
        app|contains:
            - 'Vice Streets'
            - 'Chaos With Friends'
            - 'Chicken Road'
            - 'Ice Fishing'
            - 'Grand Theft Auto'
    condition: selection_package or selection_app
falsepositives:
    - Users who legitimately installed the deceptively marketed apps before they were removed from the store; still worth alerting for remediation and uninstall
level: high

Known false positives:

• Users who installed the deceptive apps before they were delisted (remediation alert, not a false alarm)
• Reverse engineers or researchers visiting the listing URL

Tuning notes: IOCs derive from vendor disclosure (Bitdefender/Zimperium) and have zero community corroboration (TL_OSINT_Scan), so pair this IOC match with the behavioural privilege-abuse rules (SPL/KQL/SIG-002) and treat listing-URL-only hits as lower confidence. Add newly observed Early Access packages from the same developer accounts to the watchlist to stay ahead of clone listings.

• 🔒 Deceptive Early Access Package Installed on Managed Android Device (Exploitation) · unlock with TL Creds
• 🔒 Android App Granting Launcher/Notification-Listener/Overlay/Accessibility Privileges (Post-Exploitation) · unlock with TL Creds
• 🔒 Android Device Contacting APK Mirror or Gambling/Ad-Fraud Infrastructure (C2) · unlock with TL Creds
• 🔒 Web Access to APK Mirrors Hosting the Delisted Deceptive Package (Exploitation) · unlock with TL Creds
• 🔒 Known Campaign Package Running With Launcher or Dangerous Permissions (Post-Exploitation) · unlock with TL Creds
• 🔒 Mobile Client Traffic to Gambling-Affiliate Origins (C2) · unlock with TL Creds
• 🔒 Utility App Granted Launcher Plus Overlay/Notification/Accessibility Privileges (Post-Exploitation) · unlock with TL Creds
• 🔒 Hidden-WebView Ad-Click Monetization Burst From Mobile Device (C2) · unlock with TL Creds

Indicators of compromise

As of 2026-09-25, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-2655.

Sample indicators (2 of 10)

• Domain: apkcombo[.]com
• Domain: apkpure[.]com

Defanged, TLP:CLEAR. Full set of 10 indicators: unlock with TL Creds.

Technical analysis

The apps are promoted through TikTok and Facebook ads featuring AI-generated celebrity deepfakes, promise cash, PayPal, crypto, and gift-card payouts that never arrive, and monetize users via endless advertisements; at least one disguised utility requested Android launcher privileges capable of credential and 2FA capture. Google has been notified and is investigating.

On 10 September 2026, Bitdefender Labs security analyst Silviu Stahie published an investigation showing that Google Play's Early Access program has become a blind spot abused by deceptive app developers. The Early Access program strips public star ratings and written reviews from app listings while they remain in Early Access, removing one of Google Play's most important trust signals. Bitdefender's telemetry identified thousands of Early Access apps exhibiting deceptive patterns: fake casino games, slot-machine imitations, reward and 'earn money' applications, misleading utilities (PDF readers, QR scanners, phone trackers), and games abusing recognizable third-party trademarks. Because listings can remain in perpetual Early Access, several accumulated hundreds of thousands to over one million installs with zero public feedback available to warn prospective users. As Bitdefender noted, the same feature that shields developers from unfair criticism also strips users of the earliest warning that an app cannot be trusted.

The campaign exploits trust in the official distribution channel itself. Users are far more willing to install an app that comes from the Google Play Store, and the absence of ratings removes the standard red flag. Named deceptive apps documented across the investigation include at least two titles uploaded as 'Grand Theft Auto V (Early Access)' and later renamed once they had been indexed by Google search, with AI-generated screenshots that do not reflect actual gameplay; one such title, the GTA-styled game 'Vice Streets: Open World' (Android package com.gamblechaos.withfriends.game), surpassed 1,000,000 downloads with no reviews or ratings before it was removed from the store. After its removal, new listings carrying the same 'Grand Theft Auto V (Early Access)' name appeared. Third-party APK mirrors record the same package also being published under the label 'Chaos With Friends' by the Google Play developer account 'STOCK AGE INTERNATIONAL' (version 0.3, last updated 11 August 2026, Android 7.1+). Additional named lures include the fake money games 'Chicken Road' and 'Ice Fishing', which promise cash multipliers while operating an engagement loop: users receive generous virtual rewards immediately, but progress slows dramatically at the withdrawal threshold, PayPal or cryptocurrency payouts never arrive, and the app serves advertisement after advertisement — illicit ad revenue being the intended income stream. Many casino-style apps disguise themselves as casual slot and puzzle games to sidestep gambling licensing, geofencing, and age-verification requirements.

Promotion is aggressive and channel-abusing: deceptive apps are advertised on TikTok, Facebook, and other social platforms using AI-generated deepfakes of celebrities, athletes, and public figures endorsing the apps, alongside fake videos of TikTok users 'instantly receiving money'. Ad lures include claims such as 'you're getting 250 spins for free' or doubling money by helping a chicken cross a road. Ads point users directly to Early Access listings in Google Play or to gambling websites. TikTok and Facebook typically take these ads down quickly, but the operators keep producing fresh ones. Bitdefender also flagged that many PDF readers and QR scanners are the same app uploaded by seemingly different developers, with some developers repeating under different names — a pattern consistent with bulk app-production operations.

The abuse can escalate beyond fake payouts. During its investigation Bitdefender examined a QR-scanning Early Access app that attempted to convince a Pixel user to replace the official Android launcher. A QR scanner requires only camera access and has zero legitimate reason to act as a home-screen replacement. If granted launcher status, such an app could run continuously in the background, silently load hidden WebViews to click advertisements (clickjacking), display fake login screens, intercept taps, and capture two-factor authentication codes delivered through notifications. Stahie warned that the developers behind these apps could push an update that makes them 'extremely dangerous' once they accumulate popularity, evolving a benign-looking utility into a fully malicious threat.

Google was notified of the findings and confirmed it is investigating. Zimperium's Mobile Threat Watch summary (25 September 2026) framed the activity for mobile defenders as the abuse of a trusted mobile distribution channel as an entry point for social engineering. Recommended defenses include evaluating app behavior beyond installation, limiting downloads to verified sources, deploying mobile threat defense, provisioning Android Enterprise Work Profiles on BYOD devices to isolate work data from personal apps, and using Google Workspace admin controls to disable or restrict Early Access app installation across the organization.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036 Masquerading; T1684.001 Impersonation

Credential Access

T1111 Multi-Factor Authentication Interception; T1417 Input Capture

Execution

T1204.002 User Execution: Malicious File

Collection

T1517 Access Notifications

Initial Access

T1566.002 Phishing: Spearphishing Link

Resource Development

T1585.001 Establish Accounts: Social Media Accounts; T1587.001 Develop Capabilities: Malware; T1608.001 Stage Capabilities: Upload Malware

Remediation

Immediate actions

• Use mobile threat defense / MDM to blocklist package com.gamblechaos.withfriends.game and any Early Access listings from unknown or newly created developer accounts
• Enable Google Play Protect enhanced scanning and review its alerts on managed devices
• Disable Early Access app availability for the organization (or by organizational unit/group) in Google Workspace admin
• Audit and revoke launcher/home-screen (CATEGORY_HOME), notification-access, and overlay permissions granted to utility apps such as QR scanners and PDF readers
• Warn users: Play Store listings without public ratings or reviews (Early Access) carry elevated scam risk

Workarounds

• Treat any Early Access listing as untrusted until public reviews and ratings are available
• Block installs from unofficial APK mirror sites (e.g., apkcombo.com, apkpure.com) that rehost delisted deceptive packages
• Limit social-media click-through to app installs by default on managed devices

Longer-term hardening

• Provision Android Enterprise Work Profiles on BYOD devices to separate and sandbox personal apps from work data
• Stand up app-vetting and continuous mobile monitoring; evaluate app behavior (permissions, background processes, WebView activity) beyond installation
• Deliver employee security awareness focused on review-evading store listings, deepfake-ad lures, and promised-payout scams
• Pressure and monitor platform remediation: Google Play Early Access abuse verification and faster enforcement on trademark-infringing listings

Affected and fixed versions

• Google — Google Play Store (Early Access program)
  Vulnerable versions: All current Google Play client versions supporting Early Access listings; Perpetual Early Access listings — program feature disables public ratings and reviews
• Google — Android
  Vulnerable versions: Android 7.1 and later (minSdkVersion of observed deceptive apps)

Timeline

• 2026-08-11 Deceptive app 'Vice Streets: Open World' / 'Chaos With Friends' (package com.gamblechaos.withfriends.game) last updated as version 0.3 by Google Play developer account STOCK AGE INTERNATIONAL; listing remained in Early Access with no public ratings while accumulating installs (APK mirrors record the metadata after delisting).
• 2026-09-10 Operators continue reposting TikTok and Facebook ads built around AI-generated celebrity deepfakes (e.g., '250 free spins' lures, instant-cash claims) after each ad takedown; ads point directly to Early Access Play listings or gambling websites.
• 2026-09-10 The GTA-styled fake 'Grand Theft Auto V (Early Access)' game 'Vice Streets: Open World' (package com.gamblechaos.withfriends.game, over 1,000,000 downloads, no reviews) is no longer available on Google Play; Bitdefender observes new listings popping up under the same GTA V name afterward.
• 2026-09-10 Bitdefender notifies Google of the fraudulent Early Access listings; Google confirms it is investigating the situation.
• 2026-09-10 Bitdefender Labs (security analyst Silviu Stahie) publishes its investigation showing thousands of deceptive Early Access apps on Google Play - fake casino games, reward/earn-money apps, misleading utilities, and trademark-infringing titles - abusing the program's lack of public ratings and reviews.
• 2026-09-11 CSO Online details a QR-scanner Early Access app that prompted a Pixel user to replace the official Android launcher, a privilege that would enable hidden-WebView ad clicking, fake login screens, tap interception, and capture of 2FA codes from notifications; advises Android Enterprise Work Profiles for BYOD.
• 2026-09-25 Zimperium's Mobile Threat Watch summarizes the Bitdefender investigation for mobile defenders, framing the campaign as exploitation of trusted mobile distribution channels as an entry point for social engineering.

Sources cited

• Deceptive Apps Exploit Google Play Early Access to Reach Mobile Users zimperium.com · Blog · 2026-09-25
• Google Play's Early Access program may be exploited by potentially deceptive apps bitdefender.com · Blog · 2026-09-10
• Google Play Early Access Abused to Push Thousands of Deceptive Android Apps The Hacker News · News · 2026-09-10
• Google's Early Access is creating a blind spot for malicious apps csoonline.com · News · 2026-09-11
• Google Play Early Access Abused to Push Deceptive Android Apps technadu.com · News · 2026-09-10
• Deceptive apps abuse Google Play Early Access cybernews.com · News · 2026-09-10
• Google's Early Access is creating a blind spot for malicious apps (syndicated coverage) zerohour.day · News · 2026-09-11

More in malware

• PureRAT and PureLogs Campaign Targeting Japanese Organizations (Phishing, Donut Loader, BYOVD via Lenovo-signed BootRepair.sys)
• SnakeKeylogger infostealer delivered via quote-request phishing emails (JavaScript/PowerShell chain, process hollowing into aspnet_compiler.exe)
• SCKit Campaign: Rogue ScreenConnect Clients Deployed Across 288 Devices at 48 Organizations via Hijacked ScreenConnect Panels and RMM+ Extension
• Threat actors weaponizing GSocket (gs-netcat) for stealthy C2 and persistence on compromised Linux web servers (CVE-2026-43284 LPE attempts)
• eBPF Rootkits Gaining Traction on Underground Forums (Flare research; BPFDoor, Symbiote, LinkPro, CVE-2017-16995 reposts)

Previous and next in malware

• Malspam campaign weaponizes business-complaint lures to deliver PureRAT and PureLogs Previous report
• Lunex Stealer Abuses Vulnerable AMD Radeon Driver (CVE-2023-20598) to Blind Security Monitoring and Steal Browser/Crypto Credentials Next report