Play Store Fleeceware: Detecting Fake Call History Apps in the Wild

Just saw the report on the 7.3 million downloads for those fake call history apps. It’s wild that these made it past the Play Store vetting, but looking at the technical side, this is classic fleeceware behavior—social engineering masked as a utility tool.

While these don't leverage a zero-day CVE, the methodology is consistent: they aggressively request READ_CALL_LOG and READ_CONTACTS permissions, then immediately funnel users to a subscription wall. The malicious payload is the fraudulent billing logic, not a traditional exploit.

For those managing BYOD or corporate devices, blocking these purely by reputation is tough since they aren't flagged as malware by most AVs (they technically do show a call history, just a fake one). We need to look at behavioral heuristics.

I've put together a quick Python script using adb to scan connected devices for packages matching the naming conventions and high-risk permission sets typically associated with this campaign:

import subprocess
import re

# Regex patterns derived from similar fleeceware campaigns
suspicious_pkg_patterns = [
    r"com\..*call.*history.*",
    r"com\..*tracker.*pro.*",
    r"com\..*lookup.*2026.*"
]

def check_high_risk_permissions(device_id):
    # Check for apps holding READ_CALL_LOG and CONTACTS simultaneously
    cmd = f"adb -s {device_id} shell pm list packages -f"
    result = subprocess.run(cmd.split(), capture_output=True, text=True)
    
    for line in result.stdout.splitlines():
        for pattern in suspicious_pkg_patterns:
            if re.search(pattern, line):
                print(f"[!] Suspicious package detected: {line}")

# Iterate over connected devices
device_check = subprocess.run(["adb", "devices"], capture_output=True, text=True)
for dev in device_check.stdout.splitlines():
    if "device" in dev and "List" not in dev:
        check_high_risk_permissions(dev.split()[0])

Has anyone else seen these popping up in their mobile telemetry? What are you using to flag 'fleeceware' that doesn't trip standard malware signatures?