Google Play

Group-IB Discovers RemControl Android Banking Trojan Using Dynamic Overlay Attacks to Steal Banking PINs

Group-IB has identified a new Android banking trojan named RemControl with samples dating back to July 2026. The malware targets more than 30 financial institutions across Europe, the Middle East, and Canada, with Italy and France as primary focus areas. RemControl employs an overlay technique that displays a full-screen phishing replica of the legitimate banking app when the victim launches the real application, capturing PINs, access codes, and card details before seamlessly returning control to the authentic app. Phishing screens are not bundled in the APK but are fetched dynamically from operator-controlled servers reachable via Telegram channels, allowing rapid target changes without reinfection. Distribution relies on fake Google Play listing pages that mimic a streaming application, with geo-targeted delivery for Italian visitors. The trojan requests VPN permissions to block Play Store traffic and bypass real-time security checks, followed by accessibility service access that enables screen reading, keystroke logging, remote taps, and unlock pattern reconstruction.

Fake GTA and Ghost Casino Apps Flood Google Play Early Access with Scam Promises

Unscrupulous developers are exploiting Google Play's Early Access program to distribute applications that make false promises of earnings through fake games and casino experiences. These apps lack public ratings and reviews, preventing disappointed users from warning others before installation. Bitdefender reports that the scheme is heavily promoted via advertisements on TikTok, Facebook, and other social networks, often featuring deepfakes of actors, athletes, and celebrities to build credibility. Users are lured with offers of PayPal payments, cryptocurrency, gift cards, and casino jackpots, but the apps deliberately slow progress near withdrawal thresholds. After installation, the software displays generous virtual winnings that never translate into real payouts. The campaign relies on aggressive advertising and misleading interfaces to maximize installations before users realize the fraud.

Google Introduces Multi-Step Verification for Android APK Sideloading to Combat Fraud

Google has begun rolling out an enhanced installation flow for Android apps installed outside of Google Play. Users must first confirm that no one is coercing them to enable unknown sources, then reboot their device and wait 24 hours before the option becomes available. The new process includes explicit warnings about scammers who pressure victims into enabling sideloading, noting that legitimate organizations never require this setting. After the waiting period, users can grant the permission for seven days or indefinitely. The change does not affect ADB installations, preserving a workaround for advanced users. Google states the delay is intended to give people time to reconsider before enabling potentially risky settings. An Android Authority poll showed 88 percent of respondents expect further restrictions in the future.

Multiple Ozon Apps Removed from Google Play Following Sanctions on Ozon Bank

Several Ozon applications have been removed from the Google Play store, affecting Android users who can no longer download the main Ozon client along with Ozon Fresh, Ozon Seller, Ozon Job and Ozon Travel. Ozon stated that the company did not violate Google Play rules, yet the exact reasons for the removals remain undisclosed. The action follows the earlier disappearance of the Ozon Bank app after the bank was placed under European Union sanctions, although no official connection has been confirmed. Apple users continue to access Ozon services through the App Store, while Android users are directed to alternative stores including RuStore, AppGallery and Galaxy Store. The company also warned against downloading APK files from unverified sources due to security risks. The removals come amid a broader wave of app store purges that also affected Yandex Pay on the App Store. Already installed applications generally continue to function, but users may face difficulties with future updates and reinstalls.

Android Banking Trojans Hide in Droppers to Bypass Google Play Checks

Kaspersky solutions blocked 1.99 million attacks involving Android malware, adware and potentially unwanted programs in the second quarter of 2026, down from 2.68 million the previous quarter. Researchers still recorded 304,000 malicious installation packages, among them 93,600 banking trojans that retained the largest share at 30.77 percent. Operators increasingly rely on droppers that pass initial store review and later download the real payload. One PDF reader application distributed through Google Play displayed a fake update prompt that installed the Anatsa banking trojan. The Cleanova dropper collected installation-source data and delivered its payload only under attacker-chosen conditions, avoiding analysis environments. The share of users hit by Trojan-Dropper.AndroidOS.Banker.dd rose sharply from 0.01 percent to 2.16 percent, while the Mamont and Creduz families continued to expand with new variants.

Telegram Briefly Removed from App Store After Apple Detects Child Sexual Abuse Material

Telegram was temporarily pulled from the App Store in multiple countries after Apple moderators identified content linked to child sexual abuse. The removal lasted roughly 20 minutes before the app was reinstated following Telegram's quick removal of the prohibited material and blocking of the responsible user. Apple cited strict App Store rules as the reason for the action. During the outage, already-installed copies continued to function normally while the app remained available via the Mac App Store and Google Play. Telegram responded on X with the quote “Rumors of my death have been greatly exaggerated” before Apple issued its official explanation. This marks at least the third documented instance of Telegram facing App Store removal, including a 2018 incident over unacceptable content and a 2024 removal from the Chinese store at the request of local regulators.

Google to Allow Competing Android App Stores Directly Inside Play Store After Epic Games Court Ruling

Google is preparing to open its official Google Play store to rival Android app marketplaces starting July 22, following a court order issued in the long-running antitrust lawsuit with Epic Games. The ruling stems from the 2020 Fortnite dispute over Google’s 30% commission and direct in-app purchases that bypassed the platform’s billing system. A federal judge determined that Google had unlawfully prevented device makers from promoting or pre-installing alternative app stores, thereby reinforcing Google Play’s monopoly position. As a result, approved third-party stores will now be distributed directly through Google Play, receive default access to its app catalog, and be subject to an annual $5,000 verification fee. Developers retain the right to block distribution of their apps on specific stores, while participating marketplaces must meet strict security, copyright, and update obligations or risk removal if suspicious installations exceed 1%. Although the changes are expected to apply primarily in the United States, the decision marks a fundamental shift in how Google must accommodate competitors within its own ecosystem.