In yet another debacle from a supposedly safe official app store, over 300 malicious apps have slipped through
A large-scale cyber threat involving over 300 harmful Android applications that have collectively amassed 60 million downloads on Google Play has been disclosed by threat researchers.
The deceptive apps, classified under the name “Vapor”, were designed to either bombard users with intrusive ads or steal sensitive information, including login credentials and credit card details.
The campaign was first identified by IAS Threat Lab, which had initially reported 180 malicious apps generating millions of fraudulent ad interactions daily. A follow-up study by Bitdefender had later expanded the count to 331 apps, with infections particularly widespread in Brazil, the US, Mexico, Turkey, and South Korea.
Although these apps have since been removed from the hackers’ playground, Google Play, security experts warn that the perpetrators may return with new applications, having already demonstrated their ability to bypass Google’s screening process.
How Vapor apps operated
These apps posed as everyday utilities, such as fitness trackers, note-taking apps, battery optimizers, and QR scanners. Upon initial submission, they appeared legitimate, successfully passing Google’s security reviews. However, once installed, the apps downloaded hidden malware from external servers, enabling harmful functionality post-installation.
Some of the most popular fraudulent apps included:
- AquaTracker, ClickSave Downloader, Scan Hawk, Water Time Tracker – each with over 1m downloads
- BeatWatch – 500,000 downloads
- TranslateScan, Handset Locator – smaller but still concerning download numbers
To evade detection, developers spread these apps across multiple accounts, ensuring that the removal of one would not disrupt the entire operation.
Hidden threats and user impact
Once installed, these apps concealed their icons, making them difficult to locate and uninstall. Some even disguised themselves as Android’s system modules. These apps ran in the background, launching deceptive ads that covered the entire screen while disabling navigation buttons, leaving users unable to exit.
In addition to ad fraud, several of these apps deployed fake login screens for popular apps, tricking users into providing their credentials. Others attempted to steal credit card details under false pretenses.
Google has since removed all Vapor apps and assured users that Play Protect remains active by default to detect and prevent similar threats in the future.
