Fake Chrome App With 100,000 Downloads Linked to Hizbartech on Google Play
A deceptive app mimicking Google Chrome was distributed via Google Play, reaching significant download counts before researchers identified its true developer.
Key points
- The app used the package identifier com.ballbounce.Hizbartech, linking it to a previous game called Ball Bounce.
- User reports described the app as a chat interface with AI avatars, not a web browser.
- No evidence of password theft, banking trojans, or remote control capabilities was found in reviewed reports.
A counterfeit application mimicking Google Chrome was distributed on Google Play, accumulating more than 100,000 downloads according to a screenshot cited by Cyber Security News. The listing appeared above the legitimate browser in search results, raising concerns about paid promotion mechanisms.
The app copied Google Chrome’s name, icon, and description text, but the developer field listed Hizbartech instead of Google LLC. Cyber Security News noted that the download count badge does not confirm how many users installed the app while it bore the Chrome branding.
Context and Background
Researchers at PiunikaWeb identified the deceptive listing after a user on the Reddit community r/browsers flagged the anomaly on October 14. The researchers reported that searching for the developer’s name still yielded the app, although they could not independently reproduce the sponsored search placement.
PiunikaWeb traced the application’s history to a game titled Ball Bounce, which reportedly appeared in August before changing its branding in late September. Android Authority reported an initial listing on August 22 and a branding change on September 30, while SammyGuru found an archive suggesting availability as early as July.
The package identifier com.ballbounce.Hizbartech provided a technical link between the game and the fake browser. This identifier, unlike the visible name or icon, allowed investigators to connect the two versions of the application, serving as a search clue for device checks rather than proof of malicious function.
Who Is Affected
Users who installed the 42 MB application reported finding a contacts-style interface with AI avatars, according to PiunikaWeb citations of Reddit users. Android Authority described the software as a chat app with prepared responses, explaining the mismatch between the listing’s browser claims and its actual behavior.
These accounts are not a published code review, and no reviewed report supplied evidence of browser password theft, remote control, or hidden banking screens in this specific app. Past reporting on fake Chrome installation pages has described SpyNote delivered through lookalike websites, but that was a separate campaign.
Its capabilities and indicators should not be assigned to this Google Play listing. Available reports do not establish password theft, a banking Trojan, or a confirmed malware payload for this specific Hizbartech application. This differs from earlier Threat Times reporting on fake Calendly pages stealing Meta and Google logins, as no credential theft was confirmed here.
What should you do?
Security professionals should monitor for applications that change branding after initial release, using package identifiers to trace history. Organizations should review device management logs for installations of apps with package names like com.ballbounce.Hizbartech.
What to do and how to stay safe: Google Play
- Check device installation logs for apps with package identifiers matching known deceptive listings or sudden branding changes.
- Verify the developer name in app store listings before installing software, ensuring it matches the official vendor.
- Monitor network traffic for unexpected connections from newly installed applications that do not match their stated function.
- Educate users to ignore sponsored search results for well-known software, directing them to official vendor sites instead.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the fake Chrome app steal passwords or contain banking malware?
No reviewed report supplied evidence of password theft, remote control, or hidden banking screens in this specific app.
Who developed the fake Chrome app on Google Play?
The listing identified Hizbartech as the developer, rather than Google LLC, and used the package identifier com.ballbounce.Hizbartech.
How many people downloaded the deceptive application?
A screenshot showed more than 100,000 downloads, though this badge does not prove all installations occurred while it carried Chrome branding.
