CTM360 Uncovers Massive Play Store Scam Distributing PlayPraetor Trojan

CTM360 has identified a large-scale cyber scam targeting global users through fraudulent Google Play Store pages. Over 6,000 fake pages have been discovered, luring victims into downloading malicious apps embedded with the PlayPraetor Trojan. This sophisticated malware seizes control of infected devices to steal banking credentials, track keystrokes, and access clipboard data, posing severe risks to user security.

Cybercriminals use deceptive tactics to distribute PlayPraetor:

• Fake Play Store Pages – Fraudulent websites closely mimic Google Play, tricking users into downloading Trojanized APKs.
• Disguised Malware – Malicious apps impersonate legitimate software, using similar branding to evade detection.
• Excessive Permissions – Once installed, these apps request dangerous access to Accessibility Services, enabling keylogging and data theft.
• Banking Fraud – The Trojan scans for financial apps, intercepts credentials, and steals MFA codes for unauthorized transactions.
  
  

The malware enables multiple cyber fraud strategies:

• Credential Theft & Account Takeover – Stolen banking logins are used for unauthorized access.
• Personal Data Harvesting – Victims' details are collected for phishing and identity theft.
• SMS & OTP Interception – Bypasses two-factor authentication to facilitate financial fraud.
• Ad Fraud & Botnet Operations – Infected devices are used for click fraud and cyberattacks.

With thousands of fraudulent pages detected, PlayPraetor is one of the most widespread Play Store scams to date. Users must remain vigilant, as attackers continue refining their tactics to exploit digital trust.