TikTok ads for fake stalkerware apps are scamming people who download them

Fake “stalkerware” apps promoted on TikTok are being used to lure would-be snoops into paying for services that do not deliver the invasive capabilities advertised, according to new research from Bitdefender.

The company said it identified apps available on official app stores, including Google Play and in at least one case the Apple App Store, advertised through TikTok campaigns claiming users could track someone’s location, access private messages, uncover hidden accounts and recover deleted photos using only a phone number.

Bitdefender said the app store listings did not make the same claims as the TikTok ads, and the apps did not provide the promised features. Instead, it said the apps appear designed to generate subscription revenue, including through “free” trials that lead to charges and subscription mechanisms that continue billing.

Bitdefender noted that if the features promoted in the ads were functional, they would likely be illegal in many jurisdictions.

Key findings:

Bitdefender said the ads are designed to exploit emotions, and in some cases used unsettling AI-generated imagery for shock value.

One app, Lens AI, was promoted in more than 3,000 ads in a single month by the company listed as its developer, Bitdefender said.

Bitdefender also said Lens AI used an icon closely resembling the Google Lens icon from 2019 to 2023. The icon was later changed on Google Play, but was kept on the iOS version, according to the research.

In another case, Bitdefender said an app advertised as able to reveal what someone is doing from their phone number was largely composed of advertising and billing software development kits, with only around 91 classes of the app’s own code for a basic photo-stamping camera. The company said this indicated the app was built to monetise users rather than track anyone.

The research also raised concerns about ratings integrity, with Bitdefender reporting that several apps had high overall ratings despite user complaints that features do not work and that “free” trials resulted in charges.

Bitdefender said it was unclear how ads promoting features that would likely be unlawful in many jurisdictions continue to run and pass platform ad review.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts