Threat Actors Weaponize Google Play Early Access for Fake Reward Apps
Threat actors are exploiting Google Play's Early Access program to distribute thousands of deceptive Android applications that promise cash rewards, cryptocurrency earnings, free spins, and premium content, according to a new report from Romanian cybersecurity firm Bitdefender. Early Access apps exist outside the official Android app marketplace, allowing developers to solicit user feedback before public release. Because these apps cannot receive public reviews or star ratings, traditional trust signals are stripped away, giving malicious actors an ideal environment to push fraudulent content without scrutiny.
Among the most egregious examples is "Vice Streets: Open World" (APK package: com.gamblechaos.withfriends.game), a Grand Theft Auto imitator that amassed more than 1 million downloads without a single user review. The app has since disappeared from the Google Play Store, though it remains unclear whether Google or the uploader removed it. Bitdefender noted that the same feature protecting developers from unfair criticism effectively deprives users of the earliest warning signs that an app cannot be trusted. Users concerned about how their device metadata is being harvested by suspicious apps can run a browser fingerprint test to understand their exposure.
The deceptive applications are aggressively promoted through TikTok, Facebook, and other social media platforms using ads that feature AI-generated deepfake videos of celebrities endorsing the apps. According to Bitdefender, the engagement loop follows a predictable pattern: users install the app after watching a video ad, receive generous virtual rewards almost immediately, but when they attempt to reach a withdrawal threshold, progression grinds to a halt and the promised payout never arrives. The true revenue model is sustained by bombarding victims with ad after ad, while also allowing operators to bypass the licensing, geofencing, and age verification requirements that legitimate gambling applications must comply with. Readers who want to verify the legitimacy of unfamiliar domains referenced in these ads should use the WHOIS lookup tool, while those worried about their overall digital exposure can run a comprehensive privacy checkup.