• Bitdefender finds Google Play Early Access platform could give malicious apps an easy breeding ground
• User reviews and ratings are not publicly displayed, removing the ability for users to evaluate if an app is legitimate
• Games, casinos, and utility apps are being loaded with malicious packages and downloaded thousands of times

Google has unveiled an Early Access program for the Play Store, allowing developers to list early-access apps for testing and feedback.

While great for smaller apps looking to weed out any wrinkles in their apps, Early Access also offers a lucrative way for malicious actors to lure users into downloading apps that look legitimate, but can hide malicious packages inside.

However, new research from Bitdefender notes the fact that the Early Access program hides public reviews and ratings could lead to an app ecosystem filled with scams, fake casinos, and malware-laden packages masquerading as legitimate software.

Early Access is filled with dangerous apps

When looking for apps on the normal Play Store, one of the first things users are greeted with is an app’s rating. For fake or malicious apps, users can quickly evaluate whether or not to download the app thanks to the star rating and user reviews. While there is the potential for nefarious developers to fake reviews and ratings there is at least some ability to check if an app is legitimate.

But the Early Access system does away with public user ratings and reviews entirely. There is effectively no way for users who fall victim to a fake app to publicly warn other users not to download the app.

Add to this equation that ability for developers to show off their apps through sponsored Facebook and TikTok videos, offering outrageous rewards or using deepfakes of celebrities to entice users to install their apps.

This is especially true for fake gambling apps. Bitdefender has spotted numerous adverts for casino apps using deepfakes of well known celebrities such as Cristiano Ronaldo, Jason Statham, and Andrew Tate. These apps actively push users into the Google Play Early Access store, or direct to the apps website.

Other listings mimic well-known apps, adding financial incentives for downloading such as doubling the money you invest every time you complete a task or overcome an obstacle. Other apps take advantage of the hype for upcoming game releases, such as Grand Theft Auto V and VI. These apps often use screenshots from the actual games in order to appear legitimate.

When detected as illegitimate, these scam apps will often be deleted before being replaced by exact copies that perform the same malicious functions. Some illegitimate apps have been downloaded thousands of times, Bitdefender said, but many remain available on the Google Play Early Access store.

But the scam apps aren’t limited to games and casino apps. Bitdefender also saw numerous apps offering utility functions such as QR code scanners or PDF readers. In some circumstances, the exact same apps were listed multiple times by different developers – likely to expand the reach and maximize the number of downloads.

Bitdefender notes that Google Play’s reputation relies on users being able to trust the apps they are downloading, but the Early Access program removes almost every way users can detect a malicious app before installing.