Full Report
Bad actors are misusing Google Play's Early Access program to push deceptive apps that claim to offer money, rewards, casino winnings, and premium content. Early Access apps are apps that haven't been released on the official Android app marketplace. The main idea behind the program is for developers to solicit user feedback for new applications or features they may be working on before their
Analysis Summary
# Tool/Technique: Google Play Early Access Abuse
## Overview
Threat actors are misusing the Google Play "Early Access" program to distribute deceptive and malicious applications. The Early Access program is intended for developers to gather feedback before an official release; however, it lacks public reviews and star ratings. Attackers exploit this lack of transparency to shield their apps from community warnings, pushing fake reward schemes, unlicensed gambling apps, and malware.
## Technical Details
- **Type:** Technique / Delivery Vector
- **Platform:** Android
- **Capabilities:** Bypassing community trust signals (reviews/ratings), evading gambling regulations (licensing/geofencing), and serving as a delivery mechanism for deceptive content or malware loaders.
- **First Seen:** Reported September 2026 (Bitdefender research)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- **T1475 - App Store Abuse**
- **TA0007 - Discovery**
- **T1426 - System Information Discovery** (via bundled malware)
- **TA0003 - Persistence**
- **T1546 - Event Triggered Execution** (via ADB scanning and shell execution)
## Functionality
### Core Capabilities
- **Review Suppression:** Leverages the Early Access policy that prevents users from posting public reviews or star ratings, effectively silencing victims who realize the app is deceptive.
- **Regulatory Evasion:** Masquerades gambling applications as casual "puzzle" or "slot" games to bypass Google Play’s strict gambling policies, age verification, and geofencing.
- **Ad-Ware Engagement Loop:** Uses aggressive advertising and virtual reward systems to keep users engaged, serving excessive ads to generate revenue while never reaching the promised payout thresholds.
### Advanced Features
- **AI-Enhanced Lures:** Uses celebrity deepfakes in social media advertisements (TikTok, Facebook) to lend false credibility to the deceptive apps.
- **Malware Bundling:** Acts as a gateway for more sophisticated threats like "Hagaseca" (RAT/Loader) and "Mantax Otax" (Ransomware/Spyware).
## Indicators of Compromise
- **File Names / Package Names:**
- `com.gamblechaos.withfriends.game` (Vice Streets: Open World)
- **Behavioral Indicators:**
- Application requests excessive permissions for casual games (e.g., ADB access).
- Rapid virtual reward accumulation followed by a "halt" in progression near withdrawal thresholds.
- Redirection from social media ads to Early Access store pages or external gambling sites.
## Associated Threat Actors
- **Hagaseca Operators:** Known for using the THost9 loader and scanning for exposed ADB services.
- **Mantax Otax Operators:** Threat actors targeting Indonesian users with hybrid ransomware/spyware.
## Detection Methods
- **Behavioral Detection:** Identifying apps that attempt to communicate with known C2 infrastructure for the Hagaseca RAT or perform encryption activities (Mantax Otax).
- **Heuristic Analysis:** Flagging "Early Access" apps with high download counts (e.g., >1 million) but zero public feedback, especially when categorized as utility or reward apps.
- **Traffic Analysis:** Monitoring for unusual outgoing traffic to unlicensed gambling domains or PayPal/Crypto-themed phishing endpoints.
## Mitigation Strategies
- **Prevention Measures:** Avoid installing "Early Access" applications unless the developer is a known and verified entity.
- **Hardening Recommendations:** Disable Android Debug Bridge (ADB) unless explicitly needed for development; keep Android OS updated to versions 10+ to mitigate legacy encryption flaws used by Mantax Otax.
- **User Education:** Train users to recognize celebrity deepfakes and "get rich quick" schemes advertised on social media.
## Related Tools/Techniques
- **Hagaseca:** A packed Android Remote Access Trojan (RAT) spread via THost9.
- **Mantax Otax:** Hybrid Indonesian mobile ransomware and spyware.
- **THost9:** A malware loader used to deliver Android payloads.