Campaign Targeting Citizens of Uzbekistan via Fake Android Apps

Webamon researchers uncovered an ongoing campaign (first seen 2 Jul 2025, last observed 3 Dec 2025 with new domains as recently as 3 Mar 2026) involving 1,484 malicious domains impersonating Google Play pages; 120 of those domains hosted fake versions of 33 popular Uzbekistan apps (banking, government, telecom, social/entertainment). The fake pages targeted high-value services with millions of legitimate downloads, and while samples were not retrieved, the actors likely deploy infostealers and/or RATs to harvest credentials and access sensitive services.