Around 20 million activity-tracking apps have been downloaded from the Google Play Store, according to software company Dr.Web (via BleepingComputer). What draws Android users to these three tracking applications so much? They advertise themselves as pedometers and health trackers that encourage you to exercise by promising to pay out cash rewards to those who meet specific targets.
According to the study from Dr.Web, these prizes are frequently impossible to obtain because users must accrue a significant number of awards before being required to view a huge number of ads in order to cash out. Users were instructed to watch more advertisements after they had already seen all of them in order to “speed up” the rewards process. “The applications did not check any of the payment-related data submitted by users, therefore the chances of obtaining any of the money promised from these apps are extremely tiny,” the research claims, despite this.
Three apps mentioned in the report remain in the Google Play Store. They are:
All three apps connect with the same command & control server. Such servers are usually used by attackers to send directions to systems infected by malware. With all three apps communicating with the same remote server, it is apparent that they have the same developer. It is also pointed out that earlier versions of the Lucky Step-Walking Tracker falsely said that users had the option of converting their rewards into gift cards for various online stores.
Remember, these crooked developers make money when you view their ads. The more ads you watch, the more money they make.
The mechanism that would convert prizes into cash was eventually deleted from the Lucky Step-Walking Tracker app update, and the interface elements that would need to be tapped to complete this conversion vanished. The prizes that had been accumulated before were now useless.
A workout program called FitStar that generates a personalized weight-loss plan for 29 rubles was also highlighted in Dr. Web’s report (equivalent to 41 U.S. cents). Nevertheless, individuals who subscribed were unaware that the program they were enrolling in was only valid for one day. Following the trial period, users were automatically renewed for an additional four days of service at 980 rubles ($13.86). The program’s full access cost 7,000 rubles ($98.98), and users’ subscriptions were automatically renewed every four days.
This app is also still listed in the Google Play Store. Comments for this app note that if you install it, the icon doesn’t show up on your phone’s list of installed apps making it hard to uninstall. The same review also notes that “The app is trying from the start to get into either Facebook or Google data…”
In the same report, Dr. Web warned that phishing apps disguised as investment apps and games were found on Google Play, measuring over 450,000 downloads.
The apps connect to a remote server upon launch and receive a configuration instructing them on what to do. Typically, the instructions involve loading phishing pages that request users to enter sensitive details.
The malicious game apps observed by Dr. Web are the following:
If any of the aforementioned phishing apps are already installed on your Android device, you should uninstall them right once. After that, conduct an antivirus scan to find and get rid of any leftovers.
Google has been questioned regarding the security of the apps that are still available on the Play Store.
Google Pixel Watch 5 (45mm)
Robert Haba is the founder and editor-in-chief of Droid Tools. A lifelong gadget enthusiast with over a decade following the Android ecosystem, he built this publication to cut through the noise and give readers honest, real-world coverage of the tech they actually use.
Rich Communication Services (RCS) has reshaped Google Messages, bringing read receipts, larger media attachments, and cross-platform messaging with iPhone users. RCS isn't without its own issues, though, and Messages has so far offered an easy way to opt out on a per-chat basis if it causes problems - a feature that now looks like it […]
AI video generation has moved well beyond experimental clips. In 2026, creators, marketing teams, agencies, and video professionals can use these tools for social content, product videos, storyboards, advertisements, B-roll, explainers, and early-stage creative concepts. The challenge is choosing the right platform. Some focus on cinematic generation, while others are better for rapid marketing production […]
Google Messages is now widely rolling out its new Keep Notes integration, following last week's September 2026 Android Drop announcement. Opening the “plus” menu inside a conversation reveals a new Keep Notes shortcut, and those pills can be reordered like usual. Alternatively, Google might surface a contextual “Create list” shortcut directly in the suggestions row. […]
Developers have discovered that Android 17 quietly blocks apps from checking whether Developer Options and USB Debugging are turned on, in what's being described as one of the release's hidden changes. Regardless of whether Developer Mode is actually enabled on a device, apps that try to read its status in Android 17 will always get […]
The next story loads as you reach the end. You can also load it using the button.
Comments & Discussions
Join the conversation! We use Disqus to handle comments. Click the button below to load the comment section.