AIRLOCKPlay Gate

Hunt

Malware that abuses Play

These impersonate Play or dropped from listings. They are not Google. Block hashes, packages, and C2 — leave the store up.

Anatsa

Fake document reader listed on Play. 100K+ downloads, June 2026.

Dropped from a Play listing. Block the installer hash and C2 — never the store itself.

Package

  • com.westhorizont.appsforge.filehorizon_explorereaddocuments

MD5

  • f72b1a333fa28b133df6476561142d6a
  • 61d25684e6f42e386f40ee60f5c54dca
  • 5f85261cf55ed10e73c9b68128092e70
  • 9b6e5703bb0dc0ce8aa98281d0821642

C2 / payload

  • 66.206.6.6:8080/disclaimer.txt
  • 162.252.173.37:85/api
  • 185.215.113.108:85/api/
  • 193.24.123.18:85/api/

Paths

  • /disclaimer.txt
  • /api
  • /api/
SpyNote

Fake Play download pages. Impersonates the store, is not the store.

Phishing / dropper infrastructure. Block the lure host and IP.

C2 / payload

  • 156.244.19.63

Lure hosts

  • bafanglaicai888.top

Paths

  • /index/index/download.html
PlayPraetor

Fake Play PWAs. Lookalike hosts, not Google.

Lure hosts mimic Play branding. Allow official Play; block these names.

C2 / payload

  • mskidsakw.top
  • fadisakwa.top

Lure hosts

  • play-google-app.ormatz.com
  • play-google-app.dr1solar.com

Report

  • Play Protect

    Report a malicious app listing

  • IC3

    FBI Internet Crime Complaint Center

  • CISA

    U.S. cyber incident reporting