Bitdefender has documented systematic abuse of Google Play's Early Access programme, which lets developers publish unreleased apps for feedback and, critically, prevents users from leaving public reviews or star ratings. Threat actors are using that review blind spot to distribute thousands of deceptive apps promising money, rewards, casino winnings and premium content, promoted through TikTok and Facebook adverts featuring AI-generated celebrity deepfakes.

The casino-oriented apps sidestep licensing, geofencing and age-verification requirements by masquerading as casual slot and puzzle games, and are aggressively promoted through social media adverts that lead to either Early Access listings or third-party gambling sites. Bitdefender framed the root problem plainly: the feature that shields legitimate developers from unfair review bombing also removes one of the community's strongest defences against deceptive software. The disclosure coincides with a cluster of new Android malware families — Hagaseca (spread via the THost9 loader and scanning exposed ADB services), Mantax Otax (hybrid spyware/ransomware aimed at Indonesian targets) and StreamRat (accessibility and MediaProjection abuse delivered through Meta and TikTok adverts to Spanish-speaking users). See gigabud-banking-trojan-builds-android-work-profiles-to-evade-fraud-checks.md.