[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Attack Surface Management](/category/attack-surface-management) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Brand Impersonation is moving into the App Store](/blog/brand-impersonation-is-moving-into-the-app-store) Publish date October 18, 2026 {x} minute read # Brand Impersonation is moving into the App Store [Get a demo](/contact-sales) [Free trial](/demo) [Scan my domain](https://www.upguard.com/tools/dark-web-scan) [Download the PDF guide](#) [Free trial](/demo) [Scan my domain](https://www.upguard.com/tools/dark-web-scan) Written by [Lance Turner](/team/lance-turner) Content Writer Lance is a technology writer with an operations and systems engineering background. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Free resource ### [Download now](#) [Apple's 2025 App Store Transparency Report](https://www.apple.com/newsroom/2026/05/the-app-store-stopped-over-2-point-2-billion-usd-in-fraudulent-transactions-in-2025/) states that the company blocked over $2.2 billion in fraudulent transactions and removed roughly 59,000 apps for bait-and-switch tactics: publishing one thing to gain approval, then swapping in something else once the app goes live. The year before, fraud accounted for [38,315 of Apple's 82,509 total app removals](https://www.apple.com/legal/more-resources/docs/2024-App-Store-Transparency-Report.pdf), roughly 46%, making it the second-largest removal category that year. Google's numbers point in the same direction: its [2025 Play & Android Ecosystem Safety Report](https://blog.google/products-and-platforms/platforms/google-play/how-we-kept-google-play-safe-in-2025/) states that Google blocked 1.75 million policy-violating apps before developers could publish them, and stopped another 872,000 high-risk apps before they reached a single user. Unfortunately, these are real, measured numbers, and not a hypothetical risk. But they describe platform-wide enforcement and not protection for any one brand. Apple and Google are policing their stores for policy violations across millions of apps. Neither checks whether a fake app uses your name or logo. That gap between the Apple App Store and Google Play, in platform-wide moderation and brand-specific exposure, is where the damage happens. A few recent cases illustrate how threat actors are exploiting this exposure. ## What's falling through the gap? In July 2025, [ThreatFabric researchers found a dropper](https://www.threatfabric.com/blogs/anatsa-targets-north-america-uses-proven-mobile-campaign-process) posing as a "PDF Update" file-reader app climb to the top three in the US Google Play "Top Free Tools" chart, with over 50,000 downloads. The app met all validation requirements when Google approved it, remained dormant for about six weeks, and then operated actively for six days, from June 24 to 30, 2025, before Google took it down. By August 2025, Zscaler ThreatLabz found that the same malware family, tracked as Anatsa/TeaBot, had [expanded its fake-overlay targeting to 831 banking](https://www.zscaler.com/blogs/security-research/android-document-readers-and-deception-tracking-latest-updates-anatsa) and cryptocurrency apps, up from 650 in the previous report. Attackers built one of the new additions, a fake "scheduled maintenance" overlay, specifically for Robinhood. That same Zscaler report provides a widely cited figure: Google Play removed 77 malicious apps that users had already installed more than 19 million times combined. They didn't all belong to one family. Adware accounted for over 66% of those installs, a family called Joker (and its Harly variant) made up about 25%, and the rest included Anatsa/TeaBot and a family called Maskware. Attackers disguised most of these as ordinary utility, personalization, entertainment, or photography apps rather than named-brand clones. Named-brand impersonation is one route into a user's phone. Looking like a harmless utility is another, and right now it's the more common one. ## Borrowing the platform's trust [Brand impersonation](https://www.upguard.com/blog/digital-brand-protection) still shows up on its own, even outside the app stores. In November 2025, Cleafy Labs found a pixel-accurate [fake Google Play listing](https://www.cleafy.com/cleafy-labs/albiriox-rat-mobile-malware-targeting-global-finance-and-crypto-wallets) for PENNY, a mainstream discount supermarket chain in Europe. Developers hosted the page outside the app stores and built it to look like a Google Play Store listing, complete with a fake install button that delivered a banking trojan called Albiriox.  Threat actors rented out Albiriox as malware-as-a-service for $650 a month. It targeted more than 400 financial apps worldwide. PENNY didn't need to be a bank to become a target. It needed to be a brand people trust enough to click without a second thought, on a page that borrowed Google Play's own look to earn that trust. ## A familiar pattern [Our first blog](https://www.upguard.com/blog/introducing-app-store-threat-detection-visibility-where-brand-monitoring-couldnt-reach) introducing the App Store Threat Detection covered a version of this same pattern: a fake Sparrow Wallet listing that remained on the Apple App Store for months despite the real developer's repeated reports, a case in which three people are now suing Apple. As with that case, what's a matter of public record here is that the lawsuit alleges Apple failed to properly vet the app; there's no ruling, dismissal, or settlement yet. It's worth being clear about what App Store Threat Detection actually does: **it surfaces the fake App Store and Google Play listing and builds the evidence file behind it. Filing a takedown request with Apple or Google remains an important step your team should take.** ## Why the app store is the easier target? A structural reason emerges for why app stores are an easier target than the open web. An operator must build, host, and discover visitors for a phishing site through link clicks. However, an app store listing discovers visitors for you: search, category rankings, and recommendation algorithms do much of the distribution work that a phishing site's operator would otherwise have to do alone. The apps also live on a platform your customers already trust, outside the [monitoring built into most brand protection tools](https://www.upguard.com/blog/the-blind-spot-in-brand-protection-why-app-stores-slip-past-standard-monitoring). That combination is how many of the cases above stayed active on the app stores for months before anyone noticed. ## How do you stop this? If your brand is worth impersonating on the open web, it's worth impersonating in an app store too, and the data above says that's already happening at scale. If you're already running Breach Risk Threat Monitoring, App Store Threat Detection uses the same Transforms and Threat Credits you have today, the same setup, same plan, one more place it looks.  Ready to find out if you already have a doppelganger in one of the app stores? While you're at it, you can now [scan more than](https://www.upguard.com/tools/dark-web-scan) the App Store and Google Play. Request a demo of Breach Risk or [start a free trial](https://www.upguard.com/product/breach-risk) to see what's currently listed under your brand's name. ‍ Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Attack Surface Management #### [Shadow MCP Servers: The AI Infrastructure You Can't See](/blog/shadow-mcp-servers) In 2012, it was Dropbox. In 2026, it’s Shadow MCP. Discover why unvetted AI agents are an invisible threat and how to regain total visibility. [](/team/shane-moosa) [Shane Moosa](#) August 25, 2026 Attack Surface Management #### [Six MCP Security Incidents Every Security Leader Should Know](/blog/mcp-security-incidents) From registry poisoning to filesystem wipes: discover the 6 MCP security incidents every leader must know to secure their AI agent workflows in 2026. [](/team/shane-moosa) [Shane Moosa](#) July 1, 2026 Attack Surface Management #### [1 in 15 MCP Servers are Lookalikes: Is Your Org at Risk?](/blog/mcp-server-lookalikes) For every official MCP server, up to 15 lookalikes exist. Learn to identify these registry-layer threats and discover methods to protect your organization. [](/team/shane-moosa) [Shane Moosa](#) May 12, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)