What is 'app impersonation' and how do threat actors use it to steal credentials from legitimate app users?

Question

Accepted Answer

App impersonation involves publishing a fake app with an identical or highly similar name, icon, and description to a popular legitimate app (banking app, email client); users who find the fake via search results or phishing download it and enter credentials, which are exfiltrated to the attacker's C2 server

Answer

Impersonation is blocked automatically by both catalogs, and a submission whose name or icon resembles a published listing is rejected during processing because the pipeline runs a similarity check (the comparison covers the artwork alongside the title): the credential theft the question describes has no route to a user, and the remaining risk sits with sideloaded copies

Answer

Impersonation is a branding dispute rather than a security matter, and the remedy is a trademark complaint because no technical control is involved (the store forwards the notice to the publisher): the credential question does not arise, and the two listings coexist meanwhile

Answer

Impersonation works against an app that has yet to launch, and an attacker registers the name ahead of the real publisher because the catalog awards it first come (the listing is reserved at submission): the credential theft happens to users searching early

What is 'app impersonation' and how do threat actors use it to steal credentials from legitimate app users?

Where this fits in the Mobile Security Fundamentals exam

One question down. Thousands to go.

What is 'app impersonation' and how do threat actors use it to steal credentials from legitimate app users?

Where this fits in the Mobile Security Fundamentals exam

More free Mobile Threats & Malware questions

One question down. Thousands to go.