Malicious Chrome App on Google Play Infected 100,000+ Users

Key Takeaways

• A fraudulent app impersonating Google Chrome appeared on the Google Play Store, accumulating over 100,000 reported downloads.
• The malicious application, developed by “Hizbartech,” mimicked Chrome’s branding, icon, and description.
• While the app’s exact malicious payload remains unconfirmed, it reportedly functioned as a chat application with AI avatars, not a web browser.
• The incident highlights significant concerns regarding Google Play’s app vetting processes and the potential for deceptive sponsored search results.
• Users are advised to verify developer names and package identifiers for legitimate applications.

Deceptive Google Chrome Impersonator Infiltrates Play Store

A counterfeit Google Chrome application, reportedly downloaded more than 100,000 times, surfaced on the Google Play Store, raising serious questions about the platform’s security checks and the integrity of its search advertising. This deceptive listing replicated the official Chrome name, icon, and description, yet was attributed to “Hizbartech” instead of Google LLC. Reports suggest the fraudulent app even appeared as a sponsored result, ranking above the authentic browser in search queries.

Despite the high download count displayed on the listing, it remains unconfirmed whether 100,000 unique users installed the app while it bore Chrome’s branding. Furthermore, current analyses have not definitively established the presence of advanced threats like password stealers, banking Trojans, or other confirmed malware payloads within the application.

Researchers at PiunikaWeb noted this deceptive application after a user brought it to light on Reddit’s r/browsers community. Their October 14 report identified the listing as adware. While they could not independently replicate the sponsored search result for Chrome, a direct search for the developer’s name, Hizbartech, still revealed the application.

Evolution of a Deceptive App

PiunikaWeb’s investigation traced the app back to an earlier iteration named “Ball Bounce,” a game reportedly launched in August before its branding was altered in late September. Android Authority documented an August 22 listing and a September 30 branding change, while SammyGuru found archival evidence suggesting availability as early as July. The precise initial launch date remains somewhat ambiguous.

The primary concern stems from this identity transformation. An application initially presented as a simple game later adopted the guise of a widely trusted web browser. Prior incidents involving malicious apps on Google Play have demonstrated how applications can undergo significant changes post-release, though the specific contents or capabilities of this Chrome impersonator are not directly comparable to those separate cases.

The package identifier, com.ballbounce.Hizbartech, served as a crucial link connecting the current deceptive listing to its previous game identity. Unlike the visible name and icon, this unique identifier provided investigators with a consistent means to track the application’s evolution. This identifier is a useful investigative clue for device checks but does not, in itself, prove specific malicious functionalities.

PiunikaWeb cited Reddit users who installed the 42 MB application and reported encountering a contacts-like interface featuring AI avatars, rather than a functional web browser. Android Authority described it as a chat application with pre-programmed responses. These user accounts clarify the disparity between the app’s advertised identity and its actual behavior, though they do not constitute a formal code review or security analysis.

No verified reports have provided evidence of browser password theft, remote control capabilities, or hidden banking screens associated with this particular app. Previous reports detailing fake Chrome installation pages involved SpyNote malware delivered via lookalike websites, which was a distinct campaign with different indicators and capabilities. Its characteristics should not be conflated with the Hizbartech Google Play listing. Similarly, stating the app “evaded detection” refers to its apparent passage through store checks, not a verified technical circumvention method.

Assessing the App’s True Nature

The available evidence does not indicate the presence of encrypted payloads, checks for test environments, delayed code downloads, or the exploitation of an Android security vulnerability. The documented issues are primarily impersonation and its reported placement as a sponsored search result.

Subsequent reports indicated that the deceptive listing had been removed from the Play Store. SammyGuru noted that its link returned a “not found” message on October 14, though it cautioned that this did not confirm a worldwide takedown. SammyGuru also highlighted discrepancies in download figures, with one screenshot showing “100,000+” and an indexed listing showing “10,000+.” These distinctions are important, as install totals, store availability, and confirmed infections represent separate metrics.

Reporting on Google Play stealth loaders describes a different technique involving fake updates and subsequent malware delivery. There is no published evidence linking this method, or specific threats like the Anatsa banking Trojan, to Hizbartech’s application.

Users should meticulously verify that the official Chrome listing explicitly names Google LLC as its publisher and utilizes com.android.chrome as its package identifier. Any individual who installed the Hizbartech imitation should immediately remove it and activate Google Play Protect for a device scan. A familiar icon, sponsored search placement, or a high download count should never override the critical step of verifying the developer. For cybersecurity teams, the package name offers a more reliable starting point for investigations than merely searching for “Chrome.”

Security personnel should examine affected devices for the presence of the listed app and any unusual permissions, carefully separating these findings from any confirmed instances of data theft, a question that remains unanswered in the public record.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Verify Developer and Package ID: Always check that the developer of any app is the official vendor (e.g., Google LLC for Chrome) and verify the package identifier (e.g., com.android.chrome). Do not rely solely on the app’s name, icon, or download count.
• Remove Suspicious Apps: If you have installed an app matching the characteristics of the Hizbartech fake Chrome app (developer Hizbartech, package ID com.ballbounce.Hizbartech), uninstall it immediately.
• Run Google Play Protect: After removal, run a scan with Google Play Protect on your Android device to detect and remove any remnants or other potentially harmful applications.
• Be Skeptical of Sponsored Results: Exercise caution with sponsored search results in app stores, as these can sometimes be exploited by malicious actors to promote fake applications.
• Review Permissions: Regularly review the permissions granted to installed applications. Be suspicious of apps requesting excessive or irrelevant permissions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.