Skip to content
Today
Sections

Security Independently confirmed2 publishers 2 min read Published Updated

Ghost casino apps exploit Google Play's ratings-free Early Access channel

Bitdefender says developers list deceptive apps in Google Play's Early Access program, where feedback goes only to the developer, then buy TikTok and Facebook ads to drive installs straight past the review layer.

The Watch · Security desk

Send a correction

Illustration accompanying Ghost casino apps exploit Google Play's ratings-free Early Access channel
Generated illustration

What happened

  • Bitdefender says deceptive developers list apps in Early Access and then buy TikTok and Facebook ads promising PayPal payouts, cryptocurrency earnings, gift cards or free casino spins to drive direct installs.
  • One recurring trick is uploading a listing as 'Grand Theft Auto V (Early Access)', waiting for Google Search to index it, then renaming the app so searches for the real game still land on it.
  • Bitdefender describes the problem as widespread, with some developer accounts appearing multiple times and some listings showing thousands of installs.

Why it matters

  • What it limits constraint The check most users and helpdesks make first, does this app have reviews and what do they say, produces nothing inside this channel, because no listing in it has reviews to compare against.
  • Who's exposed exposure Mobile policies written around install provenance still admit these apps, since Google Play is the distributor; the reputational filtering those policies implicitly leaned on does not extend to Early Access.
  • What's now possible capability Rename-after-indexing makes a search result or a shared store link an unstable pointer to a specific app, a technique that works for anything that benefits from borrowed search traffic.
  • What doesn't add up contradiction Bitdefender's widespread-abuse framing sits against SecurityWeek's note that no malware is involved and nothing clearly illegal is alleged, which decides whether the answer is takedowns or a change to Google's program rules.

Play Protect has nothing to flag here. Bitdefender's account describes apps that serve ads, not payloads [10]. The control that fails is the reputational one, and it fails by design: Early Access routes feedback from the user to the developer and never between users, so a listing carries no star rating, no review text and no warning [1]. An empty review count would normally be reason enough to back out of an ordinary Play listing, but inside Early Access it is the expected state, so the fastest check available returns the same result for a fraudulent listing and an honest one [13].

Store search is not in the path either. Users arrive from paid social ads and click through to the install [2], which leaves Play's ranking and review surfaces outside the sequence entirely [14]. For device policy the distinction is narrower than it looks: these apps are distributed by Google Play, so an allowlist or MDM rule that gates on install provenance passes them without complaint [15]. The research as reported describes no enterprise incident, no managed-device targeting and no policy bypass [16]. The gap sits in the review signal; the provenance signal still checks out.

Revenue is ad impressions. The promised payout never arrives and the app keeps serving advertisements, which Bitdefender reads as the purpose of the build [4]. Chicken Road and Ice Fishing, or variants on those names, are the two recurring shells [11], and the casino-style titles present as casual slot or puzzle games, which is also how they stay clear of the regulation a licensed gambling operator would face [5]. Many of the ads use deepfakes of athletes and actors offering free spins [6], and the renamed listings show AI-generated screenshots that do not match gameplay [8]. Scope is where the reporting stops being specific: repeat developers, and some listings at thousands of installs [9], with no dates and no developer names given [18].

The ad platforms currently handle enforcement. Bitdefender credits social networks with getting good at spotting and pulling these campaigns, and notes in the same breath that relaunching one is easy [12]. Nothing here ships as a patch and there is no deadline to name. The remedy on offer is a Google policy change that puts a rating facility or a warning on Early Access listings, and until that exists, Play's review layer offers coverage with a documented hole, one that belongs to Early Access and not to the wider store.

What to watch

  • Whether Google adds a rating facility, a warning label or enrollment limits to Early Access listings.
  • Whether an Early Access listing is later found delivering a payload, which moves this from ad fraud to malware distribution.
  • Whether Bitdefender or Google publishes developer names and install totals, turning 'widespread' into a measurable footprint.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence55
Adoption35
Hype gap+10
Incentives40
Confidence60
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Google Play's Early Access program lets users try unreleased, in-development apps and games before official launch; the conversation runs from user to developer, not between users, so the program includes no facility for inter-user recommendations, ratings or warnings.

    Reported SupportedView cited source
  2. [2]

    Bitdefender says dubious actors are exploiting the lack of public ratings and reviews by adding deceptive apps to the Early Access program, then driving users through external advertising to download directly from Early Access.

    Reported Supported Source: Bitdefender, via SecurityWeekView cited source
  3. [3]

    The apps are advertised through TikTok or Facebook with promised cash rewards: PayPal payouts, cryptocurrency earnings, gift cards, free spins or casino jackpots.

    Reported SupportedView cited source
  4. [4]

    After installation the promised payout never arrives; Bitdefender says the application continues serving advertisement after advertisement, which is likely the intended use for the developers, to make money by showing ads to as many people as possible.

    Reported Supported Source: BitdefenderView cited source
  5. [5]

    Many early access casino-style apps avoid gambling regulation by resembling casual slot games or puzzle products; Bitdefender describes this type as a 'ghost casino'.

    Reported SupportedView cited source
  6. [6]

    Bitdefender says many of the ads use deepfakes of famous athletes, actors or other public figures telling viewers they are getting 250 spins for free, alongside 'random user' adverts.

    Reported Supported Source: BitdefenderView cited source
  7. [7]

    Trademark abuse is common: a deceptive app is uploaded under a name such as 'Grand Theft Auto V (Early Access)', and after Google Search indexes it, the app is renamed, so users searching for the real product are directed to the deceptive listing.

    Reported SupportedView cited source
  8. [8]

    After the rename the same game carries a completely different title and AI-generated screenshots that are not representative of gameplay, with the app designed to serve aggressive ads.

    Reported Supported Source: BitdefenderView cited source
  9. [9]

    Bitdefender's research suggests a widespread problem, with some developers appearing multiple times and some listings showing thousands of installs.

    Reported Supported Source: BitdefenderView cited source
  10. [10]

    SecurityWeek states the scheme is not using Early Access to deliver malware, and that the deceptive developers are not being accused of anything clearly illegal, though the report says fraud comes to mind.

    Reported Supported Source: SecurityWeekView cited source
  11. [11]

    Two of the most common sham titles in the scheme are Chicken Road, a risk-and-reward mini-game, and Ice Fishing, a live dealer casino game, or variants on those names.

    Reported SupportedView cited source
  12. [12]

    Social media platforms have become adept at recognizing and removing the misleading adverts, but the process is easily repeatable and common enough for innocent users to be caught.

    Reported SupportedView cited source
  13. [13]

    A review-count or review-text check cannot distinguish a fraudulent Early Access listing from an honest one, because no Early Access listing has ratings or reviews at all.

    Derived Supported
  14. [14]

    Because installs originate from social-media ad clicks rather than store browsing, Play's search ranking and review surfaces sit outside the install path.

    Derived Supported
  15. [15]

    These apps are distributed through Google Play itself, so a mobile allowlist or MDM rule that gates on install provenance (source = Google Play) admits them.

    Derived Supported
  16. [16]

    The reported research documents no enterprise incident, no targeting of managed devices and no MDM or allowlist bypass.

    Derived Supported
  17. [17]

    Because Google Search indexes the listing under the trademarked name before the rename, a search result or listing reference no longer identifies the app it originally described.

    Derived Supported
  18. [18]

    The only quantitative scope figure reported is 'thousands of installs' on some listings; no dates and no developer names are given.

    Derived Contested

Sources

2 independent publishers whose own reporting we read for this story.

  1. securityweek.com

    1 article · September 10, 2026

    Deceptive Android Apps Exploit Google Play Early Access to Evade Reviews
  2. thehackernews.com

    2 articles · September 11, 2026

    Google Play Early Access Abused to Push Thousands of Deceptive Android Apps

Topics and entities

Topics

  • Android Security
  • Mobile app store abuse

Entities