What happened
Security researcher Alex Kleber (@privacyis1st), who tracks App Store scams, posted on X on 13 November 2026 about two App Store publishers he says are impersonating well-known apps. According to his post, the app "Authly" (developer ID 1796567865) is listed at $6.99 a week, about $363 a year, and two reviewers said they installed it while looking for Twilio's Authy; a separate publisher (developer ID 1653727587) lists "Authenticator App - Authy, 2FA" with "Duo Authy" in the subtitle. He notes that neither Twilio nor Duo is the listed seller and that the second account's Gmail-style privacy link points to a domain that does not resolve. Apple's App Store listings, checked on 13 November, show both apps live and Authly's weekly plan priced at $6.99; the impersonation claim is the researcher's, and neither publisher has been accused by Apple or any authority. Twilio (Authy) and Duo are not involved. When installing an authenticator app, check that the publisher is the company you expect before downloading or subscribing.
How the scam works
Impersonation schemes borrow a trusted name — a school, a police force, a bank, a well-known person or a regulator-registered firm — so that a message, a website or a phone number looks official. The real organisation is not involved and will not ask you to pay, log in or send money through a surprise link or an unlisted number. Look up the official contact details yourself and call or write there. If you have already paid or given personal information, contact your bank and report the incident to the police or your national cyber-crime service.
Source
Source: https://x.com/privacyis1st/status/2121206340236263616 (@privacyis1st, Nov 13, 2026, 6:39 AM ET)
