DIGITAL LIFE

CallPhantom: Fraudulent Android apps scam the curious
It sounds like a story straight out of a tech spy movie, but the damage is very real. Imagine you need to check a number's call log, or perhaps confirm a detail in a WhatsApp message history, and you find an app that promises to do exactly that in a simple way. The result? More than 7.3 million people fell into the CallPhantom trap, a sophisticated scheme that turned the Google Play Store into a veritable minefield for the wallets of less attentive users.
IT researchers from Eset have uncovered a malware campaign called “CallPhantom,” in which the masterminds behind the Android apps promise to provide call history for any number. Millions of users actually paid for this, only to receive fabricated data in the end.
In a post, the malware analysts write that the apps claim to be able to access and make available SMS histories and even WhatsApp call logs for any phone number. However, interested parties had to pay or subscribe for this. According to Eset, several million users of 28 such apps did just that. They were available for download on the Google Play Store, where they were downloaded and installed a total of around 7.3 million times. After being informed by the antivirus company, Google has now removed the apps.
The trigger was an app called “Call History of Any Number,” which had also published a list of alleged call history in its app store screenshots. These were also faked. An analysis by malware analysts revealed that the app generates random phone numbers, assigns them fixed names, times, and call durations from its source code. A payment was necessary to view the data.
The security company ESET recently exposed a network of 28 fraudulent applications that operated under a tempting premise: to give full access to call and SMS logs of any phone number. However, what these applications delivered was pure digital theater. Instead of accessing real databases or telecommunications networks, the code of these "apps" was programmed to generate names and numbers randomly.
To lend an air of plausibility to the scheme, the fraudsters included fixed names and predefined call durations in the source code, which were then randomly combined. The user saw a list that looked legitimate, but which was nothing more than a statistical combination of false data. The level of brazenness was such that the promotional screenshots in the Google Play Store even showed the fake code itself, trusting that the average user would not know how to interpret what they were seeing.
CallPhantom did not limit itself to displaying advertising; the main objective was to extort money directly. The applications required an upfront payment to release the supposed call “reports.” The situation became even more complicated because many of these titles managed to bypass Google's official billing system.
By using external payment methods — such as the UPI system, very popular in India, the main market for this attack — these applications prevented Google from processing automatic refunds after their removal. When the tech giant finally removed the 28 apps from the store, the money had already flown into accounts that were difficult to trace, leaving victims without the promised service and without their capital.
Psychological tactics to force subscription...The social engineering behind this group of apps was particularly aggressive. If a user installed the app and decided to leave without making the payment, the system would trigger a false alert. These notifications simulated the arrival of an urgent email, stating that the “requested call history was now available,” in an attempt to create a sense of urgency and curiosity that would lead the user to complete the financial transaction.
In addition, the criminals tried to disguise the common origin of the apps by using different designs and developer names. One of the most popular apps, for example, used the name “Indian gov.in” to convey a false sense of governmental authority, despite having no connection to official institutions.
How to identify these traps in the future...Although the applications have already been banned, this case serves as a warning about the importance of maintaining a critical spirit before clicking the install button. Here are some essential points to avoid becoming the next victim:
-Always read reviews carefully: In the case of CallPhantom, several users had already warned in the comments that the numbers were made up.
-Be wary of miraculous promises: Legally, no application is allowed to access the call history of third parties without explicit authorization or court orders.
-Check the payment method: If an application on the Play Store asks you to pay outside of the Google system, it is almost certainly a scam.
-Analyze the developer's name: Names that try to imitate official entities or that look like a random sequence of letters should be avoided.
The role of the App Defense Alliance in Android security...The discovery of these 28 applications was only possible thanks to the intervention of ESET, which is part of the App Defense Alliance. This partnership between Google and several cybersecurity companies serves as an extra layer of protection for the Android ecosystem, attempting to filter threats before they reach such massive installation numbers.
Despite these efforts, CallPhantom proved that, with a bit of appealing design and promises that play on human curiosity, scammers can still bypass Google's automatic filters. A word of warning: if a tool seems too powerful to be true or to be freely available in an official store, the most likely product is you—or, in this case, your bank account balance.
Eset researchers also provide a list of the 28 apps found and their hashes. The most popular was “Call history: any number deta” (calldetaila.ndcallhisto.rytogetan.ynumber) with over 3 million downloads, followed by Call History of Any Number (com.pixelxinnovation.manager) and Call Details of Any Number (com.app.call.detail.history), each with over a million downloads. Interested parties can use the list to check if they have installed the malware and then uninstall it.
Malware in smartphone app stores is not uncommon. Last August, for example, Zscaler's ThreatLabz found 77 malware apps with 19 million installations that delivered the Anatsa malware to phones. However, the “CallPhantom” campaign found now apparently contained no malware function; instead, the perpetrators simply exploited the victims' intrusive curiosity to trick them into making payments.
by mundophone




