Fake Zelle, Roblox, PayPal and Netflix apps on Google Play led to costly fake subscriptions, McAfee found

What happened

German tech site Netzwelt reported on 22 October 2026, citing research by McAfee's security experts, that fake apps imitating well-known apps such as Netflix, Roblox, CapCut, PayPal and Xbox Game Pass appeared in the official Google Play Store and steer users to expensive fake subscriptions; 444 such fake apps were seen in Germany alone. According to Netzwelt, McAfee says the fake subscriptions cost up to US$49.99 a month. Netzwelt says the apps themselves are not infected with malware, but they open a third-party website that tries to get users to sign up for a subscription, and buyers do not receive the promised service. Netzwelt published McAfee's list of the most-used fake apps, including 'Zelle Easy Secure Payments' (com.premkumar.zelleapp5, about 100,000 downloads), 'Zelle Faster Payments' (com.premkumar.zelleapp2), 'Roblox' (com.sitaram.robloxgame1, about 50,000), 'Capkut - Video Editor' (com.flintos.capcut2, about 50,000), 'PayPal - Fast Payments' (com.paypal.wallawalled11), 'Netflix Game Controller' (netflixgamecontroller.uzair1), 'Xbox Game Pass: Play Games' (xboxgame.abdul2), 'Siri Voice Assistant Android' (com.shahdi.siri2) and 'Apple Pay' (com.godwin.applepay3). Netzwelt says many of the apps it checked were already no longer available in the Play Store. Advice: delete any of these apps; if you confirmed a subscription, contact your bank or payment provider to stop payments; check the developer name, be wary of 'guide'/'tutorial' apps that send you to third-party sites, and install banking apps via your bank's official website. (McAfee's own report on this campaign is dated 7 October 2026.)

How the scam works

The fake apps rely on familiar names and icons. A search for a popular payment, streaming or gaming app in the Play Store can turn up listings that copy the brand's name, often with small spelling changes such as 'Capkut', or that call themselves guides, controllers or helpers. Netzwelt says the apps carry no malware: instead, once opened, they send users to an outside website that asks them to sign up and pay for a subscription, which can cost up to US$49.99 a month according to McAfee. Because the payment happens outside Google Play, the usual store refund and subscription controls may not apply.

Netzwelt notes that the developer names on these listings are unrelated to the real companies. Netflix, Roblox, CapCut, PayPal, Microsoft (Xbox), Apple and Zelle are impersonated, not involved, and none of them published the apps.

Source

Netzwelt, "Sofort löschen: Fälschungen von Netflix, Xbox und Roblox im Play Store entdeckt" (published 22 October 2026).