The app with no reviews had a million downloads. That was the point.

Google Play has a corner called Early Access. It exists so developers can put something unfinished in front of real users and collect feedback, and it comes with one unusual property: those listings show no public rating and no reviews. Bitdefender has now found thousands of deceptive apps parked there, making use of exactly that gap.

The pattern repeats. An advert on TikTok or Facebook, sometimes fronted by a deepfaked celebrity, promises money: PayPal payouts, crypto earnings, gift cards, casino jackpots, free spins. The link lands on an Early Access listing. Install it and the virtual winnings pile up generously at first, then progress crawls as you approach the withdrawal threshold, and the payout never arrives. What does arrive is advertising, on and on, which was always the business model. One app Bitdefender flagged, a Grand Theft Auto lookalike called Vice Streets: Open World, passed a million downloads before it vanished from the store. Others went by Chicken Road and Ice Fishing, and some were renamed after Google had indexed them, so a search for a real product quietly led somewhere else.

Bitdefender's summary of the problem is the uncomfortable bit: the same feature that shields developers from unfair criticism also strips users of the earliest warning that an app cannot be trusted. Star ratings are crude and easily gamed and still the first thing most people glance at. Remove them and the page offers nothing to push back against. Google had not commented when the research was published, and at least one of the apps has since gone.

The habit that survives all of this is treating an advert as the worst possible reason to install anything. On the Windows side, Tendvane's app updater works through winget, Microsoft's own package catalogue, so what it fetches comes from a known source rather than whatever a link promised.