11 SEP 2026 — Bitdefender has found that Google Play's Early Access programme is being used at scale to distribute deceptive apps, and the mechanism is not a technical bypass. Early Access apps cannot receive public reviews or star ratings. One game, Vice Streets: Open World, has passed a million downloads with no visible rating of any kind. Google has confirmed to Bitdefender that it is investigating.
What Early Access is for
The programme lets developers put an unfinished app in front of real users before committing to a public launch. Feedback goes privately to the developer rather than onto the listing, which is a sensible design for that purpose. A half-built game should not carry a permanent one-star average earned during testing.
The listing still sits inside Google Play. It still has the install button, the developer name, the screenshots and the implicit assurance of an official app store. It lacks the one signal a prospective user generates for themselves.
The rating is the safety mechanism
App store review is two systems working together, and only one of them is Google's.
The first is automated and manual vetting before publication, which is good at malware and poor at intent. The second is the crowd: thousands of users who install a thing, discover that the payout never arrives, and say so in public where the next person can read it. For apps that are deceptive rather than malicious — requesting no dangerous permissions, exfiltrating nothing, but simply not paying out — the second system is the only one that works.
Early Access switches off the crowd, leaving only the automated vetting that cannot see this behaviour. A rewards app that slowly stops rewarding you does not look like malware to a scanner. It is not malware; it is a business model.
What the apps promise, and how they end
The listings promise cash rewards and PayPal payouts, casino winnings and free spins, cryptocurrency earnings, gift cards and premium content. Variants present themselves as ordinary utilities — PDF readers, QR scanners — and some use trademarked names they have no right to.
The mechanic behind them is consistent. Early play is generous: virtual rewards accumulate quickly and the balance climbs toward a withdrawal threshold. As that threshold nears, progression slows sharply. The payout does not arrive, and the user's time has been converted into ad impressions at a rate the user never agreed to because they never saw it.
Nobody is defrauded of money in most cases, which is precisely why this survives. There is no chargeback, often no purchase at all, and the harm is measured in attention and expectation rather than in a transaction anyone can dispute.
The ads are the distribution
Users do not find these apps by browsing Google Play. They arrive from advertisements on TikTok and Facebook, and Bitdefender reports that those ads use AI-generated deepfakes of celebrities.
That chain matters because each link launders the next. A fabricated endorsement is the reason to click. The social platform's ad system provides the reach. The Play Store listing at the end provides the legitimacy: the user checks that the app is on the official store, finds that it is, and installs it. Missing reviews read as newness, not as a missing control, if they register at all.
The deepfake is the part that has changed recently. A convincing fake endorsement used to cost something to produce, which limited how many of these campaigns could run at once. It no longer does.
Why this lands harder in this region
Two things make Southeast Asia a natural market for this.
The region is Android-first and store-first. Regulators have spent the past year pushing users toward official distribution rather than away from it — from 30 September, Indonesia, Singapore and Thailand get Android's new sideloading rules, which make installing outside the store harder on purpose. That is sound policy. It also concentrates trust in exactly the badge these listings borrow.
And a reward app that pays in small amounts is a more serious proposition where incomes are lower. The apps are not aimed at people who would dismiss a few dollars, and the time they consume is worth more to the people most likely to try them.
What to do about it
The test is short and requires no security knowledge. If a Play Store listing shows no rating and no reviews, it is an Early Access app, and there is no crowd standing behind it. Treat it as an unreviewed download that happens to be hosted somewhere reputable.
The second test is the promise itself. An application that pays users cash for playing has to be earning more from those users than it pays out, and the only mechanism available for that is advertising. Any offer whose implied advertising revenue per user exceeds what advertising actually pays is, necessarily, not going to pay.
For parents, or anyone administering a family device, the distinction matters: an app with no rating on Google Play is not an app nobody has rated, but one nobody is allowed to rate.
What to watch
Whether Google's investigation produces a change to the programme rather than a round of removals. Removing listings addresses this set of apps; the incentive that produced them is the ratings gap, and that is a design decision rather than an enforcement backlog.
The obvious fix is also the obvious cost: allowing ratings on Early Access would restore the signal and undo the reason the programme exists. A middle option — showing users plainly that a listing cannot be rated, instead of leaving the space blank — has no such trade-off. Its absence is hard to explain.
View author profile → · Editorial policy
