Last month Google offered refunds to users who bought a fake antivirus app from Google Play, but the scam seems to be catching on. Security researchers have recently identified similar apps in both the Android and Windows Phone app stores.
Malware analysts from Kaspersky Lab found a fake app called Kaspersky Mobile in the Windows Phone Store, which is unusual because cybercriminals tend to target Google Play and because Kaspersky doesn’t even make an antivirus product for Windows Phone.
The fake app, which was available for 149 rubles or around $4, used Kaspersky’s logo and other branding elements and even pretended to scan files when run, said Roman Unuchek, senior malware analyst at Kaspersky Lab in a blog post Thursday.
Kaspersky Lab was not the only brand abused by the people behind this scam. The same developer account had created fake apps using the names and logos of other popular programs, including Avira Antivirus, Mozilla Firefox, Google Chrome, Opera Mobile, Internet Explorer and Safari.
One of the developer’s fake Windows Phone apps used the same name as a fake antivirus app found in Google Play in April—Virus Shield.
Despite costing $3.99 and doing nothing to protect devices, the Virus Shield Android app was downloaded over 10,000 times and made it into several “top paid” lists before being identified as a fraud. Google removed the application and offered refunds to affected users, as well as $5 in store credit.
The researchers also identified a Kaspersky-branded fake app in Google Play using the name Kaspersky Anti-Virus 2014. The app’s description was copied from the official Google Play page for Kaspersky Internet Security for Android, one of the company’s legitimate products.
The app’s creators didn’t even bother to add a scan simulation to the application, Unuchek said.
“It is quite possible that more and more of these fake apps will start appearing,” he said. “One thing is for sure—the mechanisms put in place by the official stores are clearly unable to combat scams like this.”