Beware of Fake Spy Apps: 7.3 Million People Have Been Affected

Beware of Fake Spy Apps: 7.3 Million People Have Been Affected

Jakarta, CNBC Indonesia - Cybersecurity researchers from ESET have discovered 28 applications on Google Play that promise access to other people’s call logs, SMS history, and WhatsApp call history. These apps have been downloaded more than 7.3 million times.

ESET researchers revealed detailed information about the scam in a WeLiveSecurity report, where they collectively refer to these malicious apps as ‘CallPhantom’.

The appearance of these fraudulent apps varies, but they share the same trick. The apps ask users to enter the phone number of the person they want to spy on and then prompt them to pay for access to the target’s communication data.

However, after users pay, the malicious apps provide fake data. ESET researchers found that some apps generate random phone numbers and pair them with existing names and call information in the code.

According to DetikInet, some of these apps also ask users to enter an email address where the collected history data will be sent. However, ESET states that the apps do not request intrusive permissions or actually access the requested data.

Although not entirely harmful, users who have already paid will lose their money and not receive the promised features. The payment system of these apps is also confusing.

Some apps use the official Google Play payment system, allowing victims to request a refund. However, ESET says that some apps redirect users to third-party payment apps or credit card forms within the app.

In one case, when a user tried to exit the app, it displayed a misleading warning with an appearance similar to a new email claiming that the call history results had arrived, but then redirected the user to a subscription screen, as quoted from Android Authority, Sunday (17/5/2026).

ESET reported these 28 malicious apps to Google on December 16. Currently, these apps have been removed from the Google Play Store.