Series of fake Android apps you should remove from your device immediately

Fake Android apps aren't just found on shady third-party app stores. Sometimes they even make their way to the Play Store. And if you've installed any of these apps, your cryptocurrency wallet is at risk.

1. 11 million Android devices infected with malware from Google Play

Fake Wallet Apps Are Stealing Users' Cryptocurrency

Researchers at Cyble Research and Intelligence Labs (CRIL) have discovered 20 cryptocurrency scam apps on the Google Play Store that impersonate legitimate wallet apps like SushiSwap, PancakeSwap, Hyperliquid, and many others, leading users to fake login pages and stealing your mnemonic phrase.

These mnemonic phrases, also known as seeds or recovery phrases, are randomly generated strings of words that you receive when you create a new cryptocurrency wallet. You should hide these phrases because they are essentially human-readable backups of your wallet's private keys.

They can help you regain access to your wallet if your device is lost or stolen. But in the wrong hands, they can also empty your cryptocurrency account. Anyone with access to your mnemonic phrase can access and control the assets in your cryptocurrency account.

CRIL's report mentions the following 20 applications:

Note : You will notice some apps are repeated in the above list. That is because many apps are impersonating the same app or sharing the same name to pretend to be the legitimate app. You can differentiate them by their respective package names.

These apps also don't use any technical tricks to trick you. They are originally phishing websites that have been converted into Android apps using the Median framework and distributed on the Play Store using the original developer account that provides the legitimate apps. Some apps bypass the framework and load the phishing website directly in the Android WebView.

Some of these developer accounts have as many as 100,000 downloads. Researchers believe these are old developer accounts that have been compromised and are now being used to distribute these fraudulent apps.

When you see a phishing site impersonating a legitimate wallet, you will be asked to enter a 12-word mnemonic phrase. As soon as you do so, you have handed over your cryptocurrency wallet keys to the hacker.

Always be careful to avoid risks!

This campaign is another reminder that you should always check reviews and app descriptions before downloading, even if you are on the official app store for your platform. When dealing with cryptocurrency apps, check to make sure you are downloading the app from the official developer and not an imposter.

Remember that legitimate cryptocurrency services will never ask for a mnemonic phrase unless you are trying to recover your account manually. If you are asked to enter a mnemonic phrase during a regular login process, something is wrong. In such cases, immediately check the website URL and if it is not a legitimate website, close that tab immediately.

Jessica Tanner

Update 11 June 2025