331 Malicious Apps with 60 Million Downloads on Google Play Bypass Android 13 Security

Bitdefender discovered a widespread Google Play campaign of 331 malicious apps (≈60M+ downloads) that abused Android 13 APIs to hide icons, launch fullscreen phishing activities without user interaction, persist via services/native code, and perform ad fraud and credential theft. The apps used advanced obfuscation and runtime anti-analysis checks; Google removed identified apps but the campaign was active as recently as March 4, 2025.