Bitdefender: Thousands of Fake Casino Apps Hide in Google Play Early Access

The programme lets developers publish unfinished apps without public ratings or reviews. Researchers say that is exactly why it is filling with "ghost casinos" and reward games that never pay out, promoted on TikTok and Facebook with deepfaked celebrities. One had more than a million downloads and not one review. Google says it is investigating.

• An analysis of Google Play apps installed by Bitdefender's users found "thousands of Early Access applications that appear to include fake casino games and reward apps, as well as titles that may infringe on third-party trademarks and potentially misleading utilities", the security firm said in a research post on 10 September
• Early Access lets developers publish apps still in development, and while an app remains in the programme users cannot leave public ratings or reviews, which Bitdefender says "removes one of Google Play's most important trust signals"
• Cybernews, which obtained Google's response, says some flagged apps had hundreds of thousands of installs and one potentially deceptive game more than a million downloads with zero ratings; Google confirmed it is investigating
• The apps are promoted on TikTok and Facebook with advertisements using AI-generated deepfakes of athletes and actors offering "250 spins for free", then serve advertisements while slowing progress towards any withdrawal threshold, Bitdefender says
• Trademark abuse includes an app listed as "Grand Theft Auto V (Early Access)" and renamed after it had been indexed by search engines, SecurityWeek reports

A Feature Built for Beta Testers, Used to Hide From Them

Bitdefender says Google Play's Early Access programme has become a home for deceptive casino-style and money-making apps because of a single design choice: while an app remains in the programme, the public cannot rate or review it. "An analysis of Google Play apps installed by Bitdefender users reveals thousands of Early Access applications that appear to include fake casino games and reward apps, as well as titles that may infringe on third-party trademarks and potentially misleading utilities," the company's Silviu Stahie wrote in a post published on 10 September and picked up this week by Cybernews, SecurityWeek and the gambling trade press. Google confirmed to Cybernews that it is investigating.

Early Access was created so developers could publish unfinished applications and collect feedback from early adopters without accumulating one-star reviews for temporary bugs. "This sounds great, in theory, but the problem is that Early Access removes one of Google Play's most important trust signals: public reviews and star ratings," Bitdefender wrote. "New users can't see whether previous users faced scams, annoying ads, fake casino payouts, or other misleading claims." The result, it said, "is an ecosystem in which consumers have almost no way to warn one another before installing questionable software".

The pattern the researchers describe begins off-platform. Users see an advertisement on TikTok or Facebook, frequently featuring AI-generated deepfakes of famous athletes or actors, promising free spins, cash rewards, PayPal payouts, cryptocurrency or gift cards. Some of the advertisements pointed to Early Access listings; others went directly to gambling websites. Once installed, the app may pay generous virtual rewards immediately, "but when they reach a withdrawal threshold, progression slows dramatically. The promised payout will never arrive." Instead, Bitdefender said, "the application continues serving advertisement after advertisement, which is likely the intended use for the developers". Among the most abused formats are "Chicken Road" and "Ice Fishing" games that promise to multiply money staked each time an on-screen chicken crosses a road without being hit.

Ghost Casinos, Borrowed Names and a Million Downloads

Bitdefender calls the category "Early Access ghost casinos". Legitimate gambling apps face licensing, geofencing and age verification depending on jurisdiction; the apps it found avoid those expectations "because they don't necessarily present themselves as regulated gambling products" and instead resemble casual slot, reward or puzzle games. Trademark abuse is common: SecurityWeek reports that one strategy is to upload an app under an established name, such as "Grand Theft Auto V (Early Access)", wait for search engines to index it, then rename it so that anyone searching for the real product is directed to the imitation. Some developers appear multiple times in the catalogue with similar titles.

Cybernews, which contacted Google, reports that several of the flagged apps had hundreds of thousands of installs and that one potentially deceptive game had more than a million downloads with no ratings or reviews. TikTok and Facebook are "usually quick to take down these ads and videos", Bitdefender said, "but that doesn't stop the attackers from coming up with new scenarios". Google has not said what action it will take beyond confirming an investigation.

The Store Is Doing to Ratings What the Advertisers Do to Faces

The scam has two components and both are about removing signals. The advertisement replaces a real endorser with a deepfake, the technique an offshore casino used this week to sell to Albertans with a fabricated Alphonso Davies's father. The listing then removes the one signal a platform provides that advertisers cannot fake, which is the verdict of previous users. Google did not design Early Access for this, but the effect is that its own store offers a rating-free zone to precisely the developers who most need one, and nothing on the listing page tells a consumer why the stars are missing.

Google Regulates the Gambling It Can See

Google has spent the year tightening the gambling it knowingly hosts. It rewrote its gambling-ad certification by country, applied the rules to every advertiser worldwide, and in Brazil reversed a Play Store ban on licensed betting apps once the state licensed them. All of that governs operators who declare themselves. The apps Bitdefender found declare themselves as puzzle games, run on advertising revenue rather than stakes, and reach users through advertisements on other companies' platforms. They sit outside the gambling policy because they never claim to be gambling, which is the reason the licensed sector should care: every "ghost casino" that pays nothing is a data point in the argument that gambling apps are scams.

A Court Has Already Said the Stores Are Not Bystanders

A federal judge ruled last year that Apple, Google and Meta must face social casino lawsuits because distributing the apps and taking a cut is conduct, not speech. Early Access ghost casinos are a weaker case, since the harm is wasted time and harvested advertising impressions rather than lost stakes, but the structural point is identical. The store chose the rules that let the apps in, chose to hide the reviews, and is the only party that can see which developers are uploading the same game under ten names. "Investigating" is the right first word. The second will need to be a policy.

Google built a room without reviews so honest developers could test in peace. Bitdefender counted who else moved in.