Below is a screenshot of banner ads inside the app (left) and an interstitial ad (right). The screenshot on the right shows how the app changes after installation, displaying a different icon and name, Telegeram (notice the extra “e”).Īs soon users try to open the app, they are bombarded with different types of ads. The screenshot below on the left shows the app as it appears in Google Play, displayed as Telegraph Chat. The only differences were that the term Telegram was changed to Telegraph Chat and the app icon was slightly altered after installation.įig 1: Fake app vs original app (Google Play Store)

The screenshot below shows the fake Telegram app (left) and the original Telegram app (right). The fake app portrayed itself as Telegraph Chat and the Play Store description of the app was precisely the same as the original Telegram app. Name: Telegraph Chat (which changes to Teleg'e'ram after installation) However, upon further analysis, we found that the fake app had been repackaged, in which case it is possible that a developer simply decompiled the original Telegram app and added advertisement libraries. We also noticed that the name and icon of the fake app changes after installation. Zscaler informed Google about the fake app and it was promptly removed from the store.īecause Telegram is partially open-source, we initially thought this fake Telegram app was a regular app implementing Telegram APIs. In reviewing activities around this matter, Zscaler ThreatLabZ researchers noticed a fake Telegram app making the rounds in the Google Play Store. Recently, the Russian government ordered the immediate blocking of the messaging app Telegram and requested its removal from the Apple App Store and Google Play Store.

Fake app icons