Some “free” apps use short trials and expensive subscriptions that can cost hundreds of dollars if you forget to cancel. Here’s how fleeceware apps work and how to stop them.

An explosion of interest in OpenAI’s sophisticated chatbot means a proliferation of “fleeceware” apps that trick users with sneaky in-app subscriptions.

Grade B · Factuality 78/100 · 35% Right-leaning

Technologie : Les applications "fleeceware", qui font payer les utilisateurs sans leur consentement à la fin de leur période d'essai, ont la cote. Elles ont ainsi été installées par plus de 600 millions d'utilisateurs de smartphones Android. Pas de quoi rire.

Technologie : Les applications "fleeceware", qui font payer les utilisateurs sans leur consentement à la fin de leur période d'essai, ont la cote. Elles ont ainsi été installées par plus de 600 millions d'utilisateurs de smartphones Android. Pas de quoi rire.

Technologie : Les applications "fleeceware", qui font payer les utilisateurs sans leur consentement à la fin de leur période d'essai, ont la cote. Elles ont ainsi été installées par plus de 600 millions d'utilisateurs de smartphones Android. Pas de quoi rire.

Technologie : Les applications "fleeceware", qui font payer les utilisateurs sans leur consentement à la fin de leur période d'essai, ont la cote. Elles ont ainsi été installées par plus de 600 millions d'utilisateurs de smartphones Android. Pas de quoi rire.

Technologie : Les applications "fleeceware", qui font payer les utilisateurs sans leur consentement à la fin de leur période d'essai, ont la cote. Elles ont ainsi été installées par plus de 600 millions d'utilisateurs de smartphones Android. Pas de quoi rire.

ESET researchers uncovered the

Fleeceware is one of the worst scams you can deal with on your device, because it has one, singular goal: extracting as much money from you as possibl

Android users are urged to immediately remove six applications—including Safety AppLock and Emoji Wallpaper—following reports that these utilities secretly execute malicious background processes. These apps, previously hosted on the Google Play Store, engage in ad fraud and unauthorized subscription sign-ups, necessitating manual deletion to ensure complete removal from devices. ## The Anatomy of the Fleeceware Exploit The malicious activity identified in these applications aligns with a cybersecurity category known as “fleeceware.” Unlike traditional malware that aims to encrypt data for ransom or exfiltrate credentials, fleeceware exploits the trust users place in legitimate-looking utility apps to trigger unauthorized recurring billing cycles. By abusing the Android Accessibility Service or obfuscating their true function within the package manifest, these apps bypass standard user scrutiny. According to researchers at Phone Arena, the list of compromised applications includes: * Safety AppLock * Convenient Scanner 2 * Push Message – Texting & SMS * Emoji Wallpaper * Separate Doc Scanner * Fingertip GameBox These applications frequently leverage “ad fraud” modules, which silently load invisible web pages in the background to inflate advertising metrics. While this drains battery life and consumes cellular data, the more immediate financial risk is the unauthorized subscription to high-cost, low-value services. ## Technical Evasion and the Limits of Play Protect Google’s Play Protect system functions as a signature-based and heuristic scanner. However, malicious actors are increasingly using polymorphic code—software that changes its appearance or signature each time it is recompiled—to evade detection. When an app is removed from the Google Play Store, it does not trigger a remote wipe of the user’s local installation. The burden of remediation remains entirely on the end-user. “The challenge with modern mobile threats is that they reside in the gray area between legitimate software functionality and malicious intent,” says Marcus Hutchins, a noted cybersecurity researcher. “Users often grant permissions for ‘accessibility’ or ‘draw over other apps’ without realizing these are the exact API hooks required for a fleeceware app to automate UI interactions and approve its own subscriptions.” ## Hardening Your Android Environment Removing the offending applications is only the first step. To verify that no residual billing agreements exist, users must audit their Google Play subscription history. Navigate to the Google Play Store, tap your profile icon, and select “Payments & Subscriptions” to identify and cancel any unrecognized charges. Android Permissions and API's | Android Malware analysis 101 The shift toward AI-driven threat detection is intended to mitigate these risks. Google has begun integrating advanced behavioral analysis into Android’s security stack, which monitors for anomalous API calls—such as an Emoji Wallpaper app requesting permission to read SMS messages or initiate network-wide background transfers. ### Recommended Security Hygiene To maintain device integrity, prioritize the following configurations: * **Permission Auditing:** Regularly check “App Permissions” in settings. If a calculator or wallpaper app requests access to your contacts or SMS, treat it as a high-risk indicator of malicious intent. * **Play Protect Verification:** Ensure that “Scan apps with Play Protect” is toggled to the “On” position in the Play Store settings. * **Source Control:** Avoid sideloading APKs from third-party repositories. Even with Google’s scanning, the official Play Store remains the most audited environment for mobile code. ## The Ecosystem War on Obfuscated Code This incident highlights a growing tension between user privacy and the open nature of the Android ecosystem. Unlike the strictly curated environment of iOS, Android’s permission model allows for deep system-level integration. While this enables powerful customization, it also creates a larger attack surface for developers who abuse Android Manifest declarations. “We are seeing a trend where malware authors are essentially ‘gaming’ the review process by keeping the app’s manifest clean during the initial submission,” notes Dr. Sarah Miller, a senior analyst at the Cybersecurity Institute. “They then push a server-side update that enables the malicious functionality only after the app has gained a significant user base. This is a cat-and-mouse game that signature-based antivirus simply cannot win alone.” As of mid-June 2026, the primary defense against these threats remains user vigilance. If an application provides a utility that seems disconnected from its requested permissions, or if your device experiences unexplained battery drain, consider the app compromised. Delete the installation, clear the application cache, and audit your linked payment methods immediately. ### Share this: * Share on Facebook (Opens in new window) Facebook * Share on X (Opens in new window) X *

Unscrupulous publishers take advantage of Play Market policy loopholes to charge app users hundreds of dollars