Key points
- The fake app used the package identifier com.ballbounce.Hizbartech to hide its true identity as a former game called Ball Bounce.
- Google removed the listing after users reported it, but no confirmed malware payload or data theft has been verified by researchers.
- The application appeared as a sponsored result above the legitimate browser, exploiting paid search visibility to attract downloads.
A deceptive application mimicking Google Chrome reached more than 100,000 downloads on Google Play before being removed, according to reports from Cyber Security News and GBHackers. The listing, published by developer Hizbartech rather than Google LLC, used paid advertising to appear above the genuine browser in search results. This incident highlights how attackers leverage store mechanics to distribute misleading software, raising concerns about how effectively app marketplaces verify developer identities and content before widespread distribution occurs.
How it unfolded
- Researchers at PiunikaWeb identified the deceptive listing on October 14 after a user on Reddit’s r/browsers community shared a screenshot showing the fake app in a sponsored position above the authentic Chrome browser.
- The app initially launched as a game named Ball Bounce in August, with Android Authority noting an August 22 listing date, and SammyGuru finding evidence of availability as early as July.
- In late September, the developer changed the app’s name, icon, and description to match Chrome, while retaining the original package identifier com.ballbounce.Hizbartech; Android Authority reported the rebranding occurred on September 30.
- Google subsequently removed the application from the store, although the exact timing of the takedown remains unspecified in the available reports.
Who is affected
Users who installed the 42 MB application encountered a contacts-style interface featuring AI avatars or chat functionality, rather than a web browser, according to user reports cited by PiunikaWeb and Android Authority. The download count of over 100,000 does not confirm that all users installed the app while it was branded as Chrome, since the listing existed as a game for weeks prior to the rebranding. No reviewed report has provided evidence that this specific app stole passwords, performed remote control, or displayed hidden banking screens, distinguishing it from other known campaigns like SpyNote.
What happens next
The removal of the app does not eliminate the risk of similar impersonation attempts, as attackers continue to exploit the gap between initial app submission and subsequent content changes. System administrators should monitor their devices for applications with the package identifier com.ballbounce.Hizbartech, as this string links the counterfeit browser to its earlier game identity. Users are advised to verify the developer name carefully, as Hizbartech was listed instead of Google LLC, and to avoid clicking on sponsored search results that appear above well-known applications.
The background in plain language
App stores use unique package identifiers to track software, which remain constant even if the app’s name or icon changes. Attackers sometimes release benign apps to build trust and download counts, then rebrand them as popular software to trick users. Paid search results can place these deceptive listings above legitimate apps, exploiting brand familiarity. Teams usually check the developer name and package ID rather than relying solely on the app title. Verify installations against official sources and review permission requests carefully.
What to do and how to stay safe: Hizbartech
- Check installed applications for the package identifier com.ballbounce.Hizbartech, which indicates the presence of this specific deceptive software.
- Verify the developer name on app listings, ensuring it matches the official vendor such as Google LLC rather than unknown entities like Hizbartech.
- Avoid clicking on sponsored search results within app stores, as these paid placements may direct users to counterfeit or misleading software.
- Review application permissions and behavior, uninstalling any app that does not match its stated purpose or exhibits unexpected chat or avatar interfaces.
Step-by-step guide: Mobile Device Security for Small Business: Control Without Cost
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the fake Chrome app steal passwords or banking data?
No reviewed report has provided evidence of password theft, remote control, or hidden banking screens in this specific app.
How many people downloaded the fake Chrome app?
The listing showed more than 100,000 downloads, but this number includes installs from when the app was a game, not just the Chrome impersonation.
Is the app still available on Google Play?
No, subsequent reporting indicates that Google removed the application from the store after the deception was identified.
