Fake Chrome App on Google Play Evades Detection and Reaches 100,000+ Downloads

A fake Google Chrome app appeared on Google Play with a screenshot showing more than 100,000 downloads, raising fresh concerns about app checks and paid search results.

The listing copied Chrome’s name, icon, and description, but its developer was Hizbartech rather than Google LLC. The app reportedly appeared above the real browser as a sponsored result.

However, the download badge does not prove that 100,000 people installed it while it carried Chrome’s branding. Available reports also do not establish password theft, a banking Trojan, or a confirmed malware payload.

Researchers at PiunikaWeb noted the deceptive app after a user on Reddit’s r/browsers community flagged it. Their October 14 report described an adware listing and said a search for the developer’s name still found it, although they could not reproduce the sponsored Chrome search result themselves.

Fake Chrome App on Google Play

PiunikaWeb traced the app to a game called Ball Bounce, which reportedly appeared in August before changing its branding in late September.

Android Authority reported an August 22 listing and a September 30 change, while SammyGuru found an archive suggesting July availability. The exact launch date remains uncertain.

The key concern is the change in identity. A listing that once presented itself as a game later borrowed the appearance of a trusted browser.

Earlier coverage of malicious Google Play apps shows how apps can change after release, although those separate cases do not establish what this copycat contained.

The suspicious package identifier, com.ballbounce.Hizbartech, also linked the listing to its earlier game identity. Unlike an app’s visible name and icon, this identifier gave investigators another way to connect the two versions.

It is a useful search clue for device checks, not proof of specific malicious functions. PiunikaWeb cited Reddit users who installed the 42 MB app and found a contacts-style interface with AI avatars rather than a browser.

Android Authority described a chat app with prepared responses. These accounts explain the mismatch between the listing and its behavior, but they are not a published code review.

No reviewed report supplied evidence of browser password theft, remote control, or hidden banking screens in this app. Past reporting on fake Chrome installation pages describes SpyNote delivered through lookalike websites, but that was a different campaign.

Its capabilities and indicators should not be assigned to this Google Play listing. Likewise, saying the app “evaded detection” describes its apparent passage through store checks, not a verified technical method.

What the App Actually Did

The available evidence does not show encrypted payloads, checks for test devices, delayed code downloads, or an Android security flaw. The documented issue is impersonation and a reported sponsored placement.

Later coverage said the listing appeared to have been removed. SammyGuru reported that its link returned a not-found message on October 14, but cautioned that this did not confirm worldwide removal.

It also found conflicting download figures: 100,000+ in a screenshot and 10,000+ in an indexed listing. These limits matter because install totals, store availability, and confirmed infections are different measures.

Reporting on Google Play stealth loaders explains a separate method involving fake updates and later malware delivery. There is no published evidence connecting that technique or the Anatsa banking Trojan to Hizbartech’s app.

Users should check that the official Chrome listing names Google LLC as its publisher and uses com.android.chrome as its package identifier. Anyone who installed the Hizbartech copy should remove it and run Google Play Protect.

A familiar icon, sponsored placement, or large download badge should not replace checking the developer. For security teams, the package name offers a clearer starting point than searching only for Chrome.

Review affected devices for the listed app and unexpected permissions, while keeping any findings separate from confirmed data theft. The public record still leaves that question unanswered.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Fake Chrome App on Google Play Evades Detection and Reaches 100,000+ Downloads appeared first on Cyber Security News.