ESET Exposes CallPhantom Scam: 28 Fake Call‑History Apps With 7.3M Downloads Removed From Google Play

• ESET identified and reported 28 separate CallPhantom apps on Google Play, cumulatively downloaded more than 7.3 million times.
• 53.7% of all CallPhantom detections worldwide were found in India.Some CallPhantom apps sidestep Google Play’s official billing system, complicating victims’ refund efforts.

ESET researchers have uncovered fraudulent apps on Google Play that claim to provide the call history “for any number.” The offending apps, which ESET named CallPhantom based on their false claims, purport to provide access to call histories, SMS records, and even WhatsApp call logs for any phone number. To unlock this supposed feature, users are asked to pay — but all they get in return is randomly generated data. ESET’s investigation identified 28 such fraudulent apps, cumulatively downloaded more than 7.3 million times. As an App Defense Alliance partner, we reported our findings to Google, which removed all of the apps identified in this report from Google Play.

The CallPhantom apps mainly targeted Android users in India. Many of the apps came with India’s +91 country code preselected, and support UPI, a payment system used primarily in India. 53.7% of all CallPhantom detections worldwide were found in India.

In November 2025, we came across a Reddit post discussing an app named Call History of Any Number, found on Google Play. Unsurprisingly, our analysis showed that the ‘call history’ data provided by this app is entirely fabricated — the app generates random phone numbers and matches them with fixed names, call times, and call durations, which were embedded directly in the code, says ESET researcher Lukáš Štefanko, who uncovered the CallPhantom fraud.

In general, CallPhantom apps have a simple user interface and do not request any intrusive or sensitive permissions — they don’t need to. Coincidentally, they do not contain any functionality capable of retrieving actual call, SMS, or WhatsApp data.

In the CallPhantom apps ESET analyzed, researchers saw three different payment methods used, two of which are in violation of Google Play’s payments policy. Some of the apps relied on subscriptions via Google Play’s official billing system. Others relied on payments via a third party; in some cases, payment card checkout forms were included directly in the CallPhantom apps.

The fees requested for the fake service differ widely across the apps. The apps also appear to offer different subscription packages, such as weekly, monthly, or yearly services, with the highest requested price sitting at US$80. For the lowest “subscription tier,” the average requested price was €5.

In general, subscriptions purchased through the official Google Play billing system can be canceled. For the 28 apps described in this blog post, existing subscriptions were canceled when the apps were removed from Google Play. In some cases, refunds for Google Play purchases are possible.

If the purchase was made outside of Google Play — for example, by entering payment card details inside the app or by paying via third-party services — then Google cannot cancel the subscription or issue a refund, and users have to contact their payment provider.

For more details about CallPhantom, check out the latest ESET Research blog post, “Fake call logs, real payments: How CallPhantom tricks Android users,” on WeLiveSecurity.com. Make sure to follow ESET Research on BlueSky, and Mastodon for the latest news from ESET Research.

Deepfake Videos of Narayana Murthy and Mukesh Ambani Scammed Two to Lose ~₹ 90 Lakh

Two residents of Bengaluru fell victim to deepfake videos featuring Infosys co-founder Narayana Murthy and Reliance Industries Chairman Mukesh Ambani, collectively losing around ₹95 lakh.

These deepfake videos promoted trading platforms and promised high returns, leading the victims to invest large sums of money. One victim lost ₹67 lakh, while another lost ₹19 lakh.

First Victim:

A woman from Banashankari came across a video on social media promoting a trading platform with high returns. She clicked on a suspicious link, shared her details, and was contacted by someone claiming to be an agent. Initially, she invested ₹1.4 lakh and received ₹8,000 in returns. Encouraged by this, she invested ₹6.7 lakh but didn't receive any returns. She also lost ₹67 lakh to another platform promising work-from-home opportunities.

Second Victim:

A retired employee saw a similar video on Facebook promoting a trading platform. He transferred ₹19 lakh to two different bank accounts provided by the fraudsters but didn't receive any response after the transfer.

Both victims didn't verify the authenticity of the videos and ended up clicking on links that led to fake websites created by fraudsters. Separate cases have been registered at the CEN (Cyber Economic and Narcotics) South police station, and investigations are ongoing to track down the culprits.

Deepfake technology played a crucial role in this scam by creating highly realistic videos of Narayana Murthy and Mukesh Ambani. These videos were used to promote fraudulent trading platforms, convincing victims that the endorsements were genuine. The deepfakes were so convincing that the victims didn't question their authenticity and ended up investing large sums of money.

It's a stark reminder to always verify the authenticity of online content, especially when it involves financial investments.

It must be recalled that last year, Narayana Murthy had alerted people that many trading platforms are using his identity for promotions and said that he does not endorse any of them.

In an X post, Murthy said, “In recent months, there have been several fake news items propagated via social media apps and on various web pages available on the Internet claiming that I have endorsed or invested in automated trading applications named BTC AI Evex, British Bitcoin Profit, Bit Lyte Sync, Immediate Momentum, Capitalix Ventures etc. The news items appear on fraudulent websites that masquerade as popular newspaper websites and some of them even publish fake interviews using deepfake pictures and videos. I categorically deny any endorsement, relation or association with these applications or websites.”

In response to the deepfake scam, the Bengaluru police have taken several actions. Separate cases have been registered at the CEN (Cyber Economic and Narcotics) South police station. The police are actively investigating to track down the culprits behind the scam.

Public Awareness: Authorities have urged the public to be cautious of deepfake videos and to verify the authenticity of any suspicious content before taking any action. They have also advised people to report any such incidents to the police immediately.

Helpline: The Bengaluru City Police have launched a helpline (1930) for victims of deepfake scams to register complaints and seek assistance.

It's crucial to stay vigilant and report any suspicious activity to the authorities to help prevent such scams in the future. If you or someone you know has been affected, don't hesitate to reach out to the police for help.

6 Things you must know before downloading WhatsApp Gold

Well, if you have got an invite to upgrade your green and boring WhatsApp to a Gold and sophisticated one, sadly you have been tricked. And, if you haven't, beware, you might be next in line. For people wondering what WhatsApp Gold exactly is, here's a detailed breakdown about the same. 1) Branded as an 'exclusive version' Since exclusivity always sells more, the app has been branded as an 'exclusive version' of the original app. According to the messages received by various current WhatsApp users, 'WhatsApp Gold' will not be available to all WhatsApp users and can only be installed via an invitation. 2) Users have to click on a website to get the Gold version Once a user receives an invitation for the Gold version upgrade, they're asked to visit the website, www.goldenversion.com, and click on the link given for the Gold version to download their App. 3) Celebrity App for celebrity users The invite for the app claims that 'WhatsApp Gold' is to be used by only 'big celebrities'. Further, it also boosts about the extra features that the Gold version comes with. The extra themes apparently include ability to change and choose WhatsApp themes, send 100 images all at once as compared to the current 10 images limit, free calling, video calling ang much more. 4) Hacker's Day Out According to tech experts, the invite is a way by which hackers are stealing your phone data and keeping a close track of all your movements. Once you click on the website given and start downloading the program, the website will end up infecting your precious phone with malware, which will possibly lead to hackers stealing your important data and tracking all your activity and movements. 5) Previous Scams Involving WhatsApp Does the name, WhatsApp Plus, ring a bell? Yes, it is the same royal blue colour version that was doing rounds of the social media a few years ago. This was another WhatsApp related scam that garnered major eyeballs prior to WhatsApp Gold. Such has been the frequency and the level of these scams that WhatsApp has even included a special disclaimer about these in its FAQ section. Warning about the WhatsApp Plus App, the company came forward with the following warning for its loyal users. "WhatsApp Plus is an application that was not developed by WhatsApp, nor is it authorized by WhatsApp." "The developers of WhatsApp Plus have no relationship to WhatsApp, and we do not support WhatsApp Plus. Please be aware that WhatsApp Plus contains source code which WhatsApp cannot guarantee as safe and that your private information is potentially being passed to 3rd parties without your knowledge or authorisation." 6) WhatsApp policy on upgrades In order to make the users aware about such scams, WhatsApp has even made an effort to let WhatsApp users know about its Upgradation policy notifications in detail. According to it, the app will never send its users a text message to upgrade or download another app, in fact, it will only communicate them any Upgradation notification over official points of contact like sending an email on their registered email ids etc.