Fake Chrome App on Google Play Exceeds 100,000 Downloads, Raises App Store Scrutiny Concerns
A deceptive application impersonating Google Chrome, listed as a sponsored result on Google Play, has reportedly garnered over 100,000 downloads, prompting renewed concerns about app store vetting processes.
A fake Google Chrome application has surfaced on the Google Play Store, raising significant concerns about the effectiveness of app store security checks and the prevalence of deceptive advertising. The application, which mimicked the official Chrome browser with a similar name, icon, and description, was reportedly listed as a sponsored result, appearing prominently in search results above the legitimate browser.
While the app's listing claimed over 100,000 downloads, it's important to note that this figure does not definitively confirm the number of installations or the presence of specific malware payloads. The developer behind the fake app is identified as Hizbartech, distinct from Google LLC, the official publisher of Chrome. Researchers observed that the app's package identifier, com.ballbounce.Hizbartech, linked it to a previous game called 'Ball Bounce,' suggesting a potential rebranding or identity change after its initial release.
Reports indicate that the app did not function as a web browser. Instead, users who installed it encountered an interface resembling a contact list populated with AI avatars, rather than the expected browsing functionality. Some accounts described it as a chat application with pre-written responses. While specific malicious activities such as banking trojan deployment, password theft, or remote control capabilities have not been definitively confirmed by public reports, the deceptive nature of the app and its ability to bypass store detection mechanisms are primary concerns.
The exact timeline of the app's availability and rebranding remains somewhat uncertain, with various reports suggesting its presence as a game since at least July or August 2026, and its shift to impersonating Chrome occurring in late September. This pattern of apps changing their identity post-release is a known tactic used by malicious actors to exploit user trust and potentially distribute malware.
Security experts advise users to exercise caution when downloading applications, even those that appear legitimate or are sponsored. It is crucial to verify the publisher, which for the official Google Chrome is Google LLC, and to check the package identifier, which for Chrome is com.android.chrome. Users who may have installed the Hizbartech application are urged to remove it immediately and run Google Play Protect for a system scan.
While the app appears to have been removed from the Google Play Store, its presence highlights ongoing challenges in policing app marketplaces. The ability for such an application to reach a significant download count and be advertised as a sponsored result underscores the need for continuous improvement in automated and manual review processes by platform providers.
This incident serves as a reminder that familiar branding and high download counts are not infallible indicators of an app's legitimacy. Users should prioritize checking developer credentials and package identifiers, and be wary of apps that deviate significantly from their advertised functionality or publisher identity. For security teams, monitoring package names can offer a more reliable indicator of suspicious activity than relying solely on app titles or icons.
Indicators of compromise (IoCs) associated with this threat include the Android package name com.ballbounce.Hizbartech and the developer name Hizbartech. However, specific network indicators or malware hashes have not been publicly disclosed, limiting the ability to track its spread beyond the app store listing itself.