Welivesecurity CallPhantom Fraudulent Apps Scam Millions of Android Users
Article Content
- •28 fraudulent apps named CallPhantom were identified on Google Play.
- •The apps collectively had over 7.3 million downloads, primarily targeting users in India.
- •Users paid for fake call history data, which was entirely fabricated.
A series of fraudulent apps named CallPhantom were discovered on Google Play, promising access to call histories for any phone number. Users were tricked into paying for subscriptions, only to receive fabricated data. ESET identified 28 such apps, which collectively garnered over 7.3 million downloads, primarily targeting users in India and the Asia-Pacific region. The apps generated random call data and displayed it to users after payment. ESET reported these apps to Google, leading to their removal from the Play Store in December 2025. User reviews indicated widespread dissatisfaction, with many victims claiming they were scammed. The apps exploited users' curiosity about private communication data. No malware was found in these apps, indicating a purely fraudulent scheme.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (7)
Following this threat?
Track Apt28, Snake and Cert-ua in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical RCE Vulnerability in Zimbra Exploited by Attackers A critical remote code execution vulnerability (CVE-2026-73570) in Zimbra Collaboration Suite is being actively exploited by attackers. The flaw, which affects versions prior to 10.1.20, allows unauthenticated attackers to execute arbitrary commands as the Zimbra user through improper input sanitization in SNMP… 
Russia's Hybrid Warfare Threatens UK with Cyberattacks and Sabotage Russia has escalated threats against the UK following its support for Ukraine, warning of 'consequences' for British involvement. Concurrently, Russian-linked cyberattacks, including a ransomware attack on the pathology lab Synnovis, have severely disrupted NHS services in London, affecting over 800 operations and 700…