Bitdefender has found thousands of apps in Google Play's Early Access program promising money they never pay: fake casino games, reward apps offering PayPal payouts, cryptocurrency or gift cards, and misleading utilities and titles that appear to borrow other companies' trademarks.

One, a Grand Theft Auto imitation called Vice Streets: Open World, passed 1 million downloads before it disappeared from the store. Google told Bitdefender it is investigating.

The apps are not sophisticated. Where they chose to live is.

What Early Access is for

Early Access is Google's program for apps that have not launched yet, found in the Play Store's For you tab under Apps in development and installed with the ordinary install button. An unfinished app should not be buried under one-star reviews for bugs its developer already knows about, so Google's help page says: "When you review early access and beta apps, only the developer can view your feedback."

Bitdefender states the consequence plainly: the program "removes one of Google Play's most important trust signals: public reviews and star ratings."

Why that is the whole trick

In Early Access none of that exists — no rating, no review count, no one-star complaints that the payout never arrived — and the reason it does not exist is a good one, which is why nothing about the listing looks wrong. A normal app eventually launches and faces public reviews. An app whose only purpose is to show advertisements has no reason to leave.

Google's help page describes what happens when an unreleased app launches; it does not describe a date by which it must.

How the money actually works

Victims arrive from ads on TikTok and Facebook, some built from AI-generated deepfakes of celebrities. Bitdefender describes the loop: users "might even receive generous virtual rewards almost immediately, but when they reach a withdrawal threshold, progression slows dramatically. The promised payout will never arrive." Meanwhile the app serves advertisement after advertisement.

Bitdefender puts the purpose plainly: the app "continues serving advertisement after advertisement, which is likely the intended use for the developers." The product is the user's attention, sold to advertisers, one more ad closer to a payout that is never coming.

None of that needs malware. It needs a listing with no public reviews and a steady flow of people sent over from social media.

What to do

  • Treat "Apps in development" as unreviewed, because it is. The absence of a rating is not neutral.
  • Do not trust an app that says it will pay you to use it and promotes itself with celebrity video. Real celebrities do not endorse cash-out games.
  • If you installed one, uninstall it and check what permissions it was given.
  • Report it to Google, since a public review is not an option.

What is not established

  • How many apps Bitdefender counted exactly, beyond "thousands", or over what period.
  • Whether Early Access has any time limit before an app must launch or leave.
  • How much advertising revenue these apps make.
  • What Google changes after its investigation.
  • Whether any of the apps carry actual malware, as opposed to deceptive advertising.