Incident Score: Analysis & Impact (GOO1778157015)

In this Rankiteo incident briefing, we review the Google Play breach identified under incident ID GOO1778157015.

The analysis begins with a detailed overview of Google Play's information like the linkedin page: https://www.linkedin.com/company/google-play, the number of followers: 4814, the industry type: IT Services and IT Consulting and the number of employees: 184 employees

After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 367 and after the incident was 343 with a difference of -24 which is could be a good indicator of the severity and impact of the incident.

In the next step of the video, we will analyze in more details the incident and the impact it had on Google Play and their customers.

Google Play Store users recently reported "Fraudulent 'CallPhantom' Apps on Google Play Scammed Millions with Fake Call History Data", a noteworthy cybersecurity incident.

A sophisticated fraud campaign involving 28 malicious Android apps collectively dubbed *CallPhantom* deceived over 7.3 million users before being removed from Google Play in December 2025.

The disruption is felt across the environment, affecting Android devices of 7.3 million users, and exposing None (fabricated data only), plus an estimated financial loss of Up to $80 per victim (subscription fees).

In response, moved swiftly to contain the threat with measures like Google removed the 28 malicious apps from Google Play, and began remediation that includes Google canceled subscriptions tied to its official billing system.

The case underscores how Closed (apps removed), teams are taking away lessons such as Deceptive apps can evade detection by dynamically fetching payment details and using third-party payment methods to bypass platform protections. Users should be cautious of apps promising unrealistic functionalities, and recommending next steps like Enhance Google Play Store vetting processes for apps offering sensitive services (e.g., call history access), Improve detection of apps using dynamic payment systems to evade platform policies and Educate users on recognizing deceptive subscription models and verifying app legitimacy.

Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.

The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.