Fake mobile games and apps: malware in APK, MOD and cracked versions
A fraudulent app may look like a popular game, a premium version of a familiar service or a free tool. Risk increases when a website, advert or message persuades you to install a file from outside a trusted app store and grant sensitive permissions.
How far did you get?
Viewing a page or downloading a file is different from installing an app. Choose what actually happened on your device.
I found a suspicious game or app
A website, advert or video offers a MOD, crack, premium or supposedly special version.
What to check →I downloaded the APK
The installer is on your phone, but you have not installed the app.
See the steps →I installed the app
The app was installed, opened or asked for phone permissions.
See urgent steps →I entered a password or payment details
You signed in through the app, entered card details or noticed unfamiliar activity.
What to do now →A familiar app name does not mean you are downloading the original
Attackers exploit brands, games and services people actively search for. A fraudulent app may copy the original icon, name and appearance. The following are examples of lures, not a claim that the genuine products are malicious.
Minecraft
Cracked or modified versions of popular games can be used as bait for a malicious download.
Geometry Dash
A paid or popular game may be offered free as a MOD or crack outside an official source.
Fake AI app
Attackers can imitate familiar AI services and pass off a harmful app as their mobile version.
Free premium music
A “premium unlocked” offer or modified streaming app may lead you away from the usual store.
Photo and AI editors
An appealing photo editor can be used as a wrapper for unwanted or malicious code.
Simple children’s games
A colourful game can appear harmless and lower a child’s or parent’s guard during installation.
An APK is not automatically malware
APK is a standard Android app installation format. The filename extension alone cannot tell you whether an app is safe. Its source, actual contents, distribution method and requested permissions all matter.
Official app
Obtained from a trusted source and the genuine publisher. Store checks reduce risk but cannot guarantee safety.
Unofficial APK
It may be legitimate, but you need to verify its origin and understand why you are installing it.
MOD / crack
A modified version is outside the original developer’s control, and someone may have changed its contents.
Fake app
It uses a familiar service’s name or graphics but actually comes from someone else.
How a fake app gets onto your phone
The attack often starts with persuasion: you are given a reason to install something differently from usual.
An attractive offer
A free game, cheat, MOD, premium features, new AI app or other tempting content.
A link to a website
The link may come from an advert, video, search result, social network, chat or forum.
Downloading an installer
You obtain an APK or another package outside the normal installation route.
Bypassing protection
Instructions may tell you to allow another installation source or ignore a security warning.
Sensitive permissions
The app may request access to SMS, notifications, files or accessibility services.
Misusing the device or data
Depending on the malware, this may lead to data theft, intrusive adverts or other harmful activity.
Why someone agrees to install it
The attacker does not explain the malware. They explain why you supposedly need to bypass the normal installation process.
“A paid game for free”
A premium game is supposedly available without paying.
“Premium unlocked”
The modified app supposedly unlocks paid features.
“The new version before everyone else”
A website promises early access or a leaked release.
Cheat or modification
The file supposedly adds money, skins, advantages or other game features.
“The official AI app”
An imitation claims to be a familiar technology service.
“You must disable protection”
A system warning is described as an error or an obstacle to installation.
What should stop you before installing
One sign does not automatically prove malware. Several together are a strong reason to stop the installation.
APK from a random website
The installer does not come from a trusted source.
Paid content for free
The offer promises something normally paid or restricted.
Disabling protection
Instructions tell you to ignore or disable a security warning.
Unknown source
You are asked to allow app installation through a browser or another unusual app.
Accessibility access
A simple game requests extensive control over the device.
SMS access
A game or simple tool wants to read or receive text messages.
Notification access
The app wants to read incoming notifications without an obvious reason.
Unclear publisher
You cannot reasonably verify who created or operates the app.
“Disable protection or the app will not work” is a major warning sign
Turn off Play Protect
An unfamiliar website should not make you disable harmful-app checks.
Ignore a security warning
Do not automatically treat a phone warning as an installation error.
Allow an unknown source
Do not do this just because an anonymous website or video tells you to.
Grant every permission
“Allow everything” is not a normal security procedure.
What to do if you already opened the app or APK
First distinguish downloading a file, installing an app, granting permissions and entering sensitive information.
1. I only found the offer
- Do not download the app.
- Do not follow instructions to disable phone protection.
- Find the app directly in the official store or on the developer’s genuine website.
- Check the actual publisher, not just the icon and name.
2. I downloaded the APK but did not install it
- Do not open the file.
- If you cannot verify its origin, delete it.
- Do not allow installation from an unknown source.
- On Android, you can run a Google Play Protect scan.
3. I installed the app
- Stop using the suspicious app. If compromise is suspected, disconnect the phone from networks while securing accounts from another trusted device.
- Review the permissions you granted.
- Revoke sensitive permissions that are active, including accessibility or device-administrator access where applicable.
- Uninstall the suspicious app. If removal is blocked, seek trusted technical help rather than following the app’s instructions.
- Run a security scan. A clean result alone does not prove the device is safe; persistent concerns may require expert assessment or a factory reset with careful restoration.
- Review SMS, notification and accessibility-service access.
- Update the operating system and other apps through official sources.
4. I entered a password or card details, or see unfamiliar activity
- Do not use the suspect device for further sensitive sign-ins.
- Change important passwords from another trusted device.
- Secure your main email account and its recovery settings.
- Review active sessions and signed-in devices.
- Contact your bank immediately if payment details or banking access may be exposed, or money is at risk; do not wait to finish other steps.
- Keep the app details, download source and incident timeline.
- Report loss or misuse to the police or the relevant reporting service in your country.
If the app may have stolen information, secure affected accounts promptly
Main email
Email access can enable password resets for other services.
Banking and payments – urgent if exposed
If money or banking access is at risk, call the bank immediately using a trusted number; do this before or alongside other account recovery.
Social networks and chats
End unfamiliar sessions and review signed-in devices.
Gaming and other accounts
Change passwords wherever the same or a similar password was used.
Keep Google Play Protect on
Play Protect checks apps from Google Play and also scans apps from other sources. It can warn about, disable or remove potentially harmful apps.
Checks during installation
Play Protect checks apps for potentially harmful behaviour.
Ongoing checks
It also checks apps after installation.
Risk warnings
It may warn about a potentially harmful or unverified app.
Blocking or removal
For known threats, Play Protect may block installation or remove the app.
Children need to know when to ask for help
Fake games can be designed to attract younger users. A practical rule works better than a vague “never download anything”.
The game is not in the store
If a website offers it only as a downloadable file, ask a parent first.
Something paid is suddenly free
“Free premium” or “unlocked” is a reason to check.
The phone asks for settings changes
Children should not allow unknown sources or change security protection on their own.
The app asks for a password
A game, Google or other account sign-in must belong to the genuine service.
The app asks for a card
Do not enter payment details into an unverified game or website for “age verification”.
It is better to ask
Make sure children know they will not get into trouble for asking or stopping an installation, and can report mistakes without fear.
What to keep if you suspect a malicious app
Quickly note the source, name and incident details if safe; do not delay securing the device or accounts. Never reopen a suspicious file just to document it.
Download source
The website, advert, social network, message or other source where you obtained the app.
App name
The exact name, icon and any displayed publisher.
Filename
The original APK or installer package filename.
Page address
Keep the URL if you can copy it safely without revisiting a suspect site.
Screenshot of the offer
The advert, page, message or instructions that led to the installation, if already available.
Granted permissions
SMS, notifications, accessibility, files or other sensitive access.
Timeline
When you downloaded and installed it, and when problems appeared.
Any resulting harm
Payments, unfamiliar sign-ins, messages or other events after installation.
Fake mobile games and apps – FAQ
Is every APK file dangerous?
No. APK is a normal Android installation format. Risk depends on origin, actual contents and requested permissions.
Is an app safe if it uses a familiar name and logo?
Not necessarily. A fake app can copy the name, icon and appearance of a genuine game or service. Also verify the real publisher and installation source.
What is a MOD or cracked app?
It is a modified version of an original app. Someone changed it outside the developer’s control, so the original product’s name does not establish its safety.
Is simply downloading an APK dangerous?
Downloading is different from installing. Do not open or install the file unless you can verify its origin safely.
What if I already installed the app?
Stop using it, revoke sensitive permissions, uninstall it and check the device. If compromise is suspected, change important passwords from another trusted device. Removal or a clean scan alone cannot undo stolen data or prove complete safety.
Does Google Play Protect help?
It is one layer of Android protection. It can detect, warn about, block, disable or remove harmful apps. It does not guarantee every app is safe or replace caution when installing.
Why is SMS or notification access suspicious?
Some legitimate apps need these permissions. For a game or simple tool, the requested access should match its actual function.
What if I entered a password or card details through the app?
Secure affected accounts from another trusted device. If card details, banking access or money may be at risk, contact your bank immediately through an independently verified channel.
Found a fake game or suspicious mobile app?
Keep the source link, app name, any available screenshot and a short account of your actions. Do not reopen the file to collect evidence. Reporting to DPP does not replace contacting your bank or police when needed.
Official stores reduce risk, but cannot guarantee complete safety. Verify the publisher and requested permissions.
Swiss NCSC: how malware reaches devices (English)