CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Android Call History Scam Apps Exfiltrate Payments via Fake Subscriptions on Google Play Store

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A coordinated fraud campaign involving 28 fraudulent Android apps on the Google Play Store tricked over 7.3 million users—primarily in India and the Asia-Pacific region—into subscribing to non-functional services promising access to call histories, SMS records, and WhatsApp call logs for any phone number. The apps, codenamed CallPhantom by ESET, lured users with claims of retrieving real call data but delivered only fabricated or random entries after payment. Subscriptions ranged from $6 to $80 and were processed via Google Play billing, third-party UPI payment apps (including Google Pay, PhonePe, and Paytm), or embedded card checkout forms. Some apps used deceptive notifications to redirect users to subscription pages upon exit, and at least one masqueraded under a fake developer identity (“Indian gov.in”) to appear legitimate. The campaign is estimated to have been active since at least November 2025 before the apps were removed from the Play Store.

Timeline

  1. 08.05.2026 18:08 1 articles · 10h ago

    CallPhantom fraudulent apps removed from Google Play Store after 7.3M downloads; payments exfiltrated via fake subscriptions

    28 Android apps falsely claiming to provide call history, SMS, and WhatsApp call log access for any phone number were removed from the Google Play Store after collectively exceeding 7.3 million downloads. The campaign, tracked as CallPhantom, targeted users in India and the Asia-Pacific since at least November 2025. Victims were coerced into paying $6–$80 via Google Play billing, third-party UPI apps (including Google Pay, PhonePe, Paytm), or embedded card forms to access fabricated data. Some apps used deceptive exit notifications to redirect users to subscription pages.

    Show sources
    Open in new tab

Information Snippets