Fake Chrome and WhatsApp Apps Infiltrate Google Play via Ads
A fraudulent clone of Google Chrome accumulated over 100,000 downloads on the official Google Play Store after securing a prominent paid sponsored placement directly above Google's legitimate web browser. The deceptive software listing mirrored the official Chrome browser name, logo graphics, promotional screenshots, and description while listing an unrelated developer named Hizbartech as its creator. The security anomaly was initially uncovered on October 14 when an online user shared screenshots demonstrating the counterfeit listing appearing alongside the authentic application. Following user complaints regarding the ad placement, Google removed the imposter listing from the storefront.
A fake version of WhatsApp was downloaded over 1 million times from the Google Play Store before Google removed the listing.
Academic research published by the National Center for Biotechnology Information notes that malware creators frequently employ application repackaging to slip malicious payloads past security defenses.
Hijacked Gaming Package and Deceptive Metrics
Technical investigations revealed that the counterfeit browser did not originate on the store as a web navigation tool. The software originally debuted on the Play Store in August 2026 as a casual mobile title named Ball Bounce under the package identifier com.ballbounce.Hizbartech. In late September 2026, the developer altered the metadata, changing the listing title, icons, and descriptions to impersonate Google Chrome while keeping the underlying game package code. This repurposing strategy allowed the app to display 100,000 historical installs accumulated during its gaming phase rather than reflecting genuine browser downloads. Consumers who installed the application reported that it launched an unrelated chat interface with digital avatars rather than functioning as a web browser.
Proliferation of Counterfeit Messaging Apps
The takedown of the fake Chrome listing was followed by the discovery of a counterfeit WhatsApp clone that reached more than 500,000 downloads on Google Play. The duplicate messaging app was identified by a Reddit contributor named 2ne1cheese in the r/mildlyinfuriating discussion forum after appearing in sponsored search placements. Published by an entity titled Agment Assets sallu, the 42MB package cloned WhatsApp promotional imagery and description text while omitting links to official terms of service. According to report findings from Android Authority, the developer may have exploited Google Play Early Access mechanics to suppress user ratings and warning reviews. WhatsApp is utilized by over 2 billion people across 180 countries, making its brand identity a primary target for impersonation campaigns.
Google investigates and acts upon brand impersonation complaints submitted through its dedicated Trademark Complaint Form to remove infringing advertisements.
Developer Account Verification and Storefront Security
Security researchers emphasized that checking developer profiles remains the primary defense against malicious Play Store clones. Official Google applications are published exclusively by Google LLC, while legitimate WhatsApp messaging software is distributed under the developer name WhatsApp LLC.
Threat Remediation and Protective Device Scanning
Advisory notices caution users that paid sponsored tags and elevated installation tallies do not guarantee software authenticity. Smartphone owners who mistakenly downloaded the fake Chrome package or Ball Bounce software are urged to uninstall the application and run device scans via Google Play Protect.