The group of fraudulent apps CallPhantom on the Play Market has amassed 7.3 million downloads.

Fraudulent CallPhantom Group on the Play Market

Google Play Market is generally considered a reliable platform for downloading Android apps, but not all programs available there are trustworthy. Those that promise “unusual” services are especially dangerous. In a campaign called CallPhantom, scammers released 28 apps that together received more than 7.3 million downloads.

How the Scheme Works

ESET experts named this group of apps CallPhantom and described their modus operandi:

* The apps appear as ordinary utilities, but the goal is to deceive users.
* Users are promised that for a fee they can read the contents of SMS messages, phone call logs, and WhatsApp conversations for any entered phone number.
* In reality they only send fabricated data. Some programs generate random numbers and match them with “recorded” calls embedded directly in the code.

Payment and Refund Attempts

* Some apps accept payment directly through Google Play, creating the illusion of a refund option.
* Others redirect users to third‑party payment services or display an in‑app card payment form.
* When attempting to close the app, a fake notification appears claiming that an email with a “report” has been received, after which the user is returned to the subscription screen.

Google and ESET’s Response

On December 16, ESET specialists discovered all 28 CallPhantom apps. By the time the news was published they had already been removed from Play‑Market, but the incident showed that even Google’s official platform can become a venue for large‑scale fraud schemes and attract a massive user base.