Hizbartech's Fake Chrome Used Ball Bounce ID, Reached 100k Installs Before Google Play Removal

A counterfeit Google Chrome application published by Hizbartech reached over 100,000 downloads on Google Play before being removed. The listing appeared above the legitimate browser in sponsored search results, exploiting brand recognition. This incident affects organizations relying on standard app store checks for endpoint security.

How did the impersonation evade initial detection?

The application initially launched as a game called Ball Bounce in August, according to Android Authority and GBHackers. It changed its name, icon, and description to mimic Chrome in late September. The package identifier remained com.ballbounce.Hizbartech, linking the new branding to the older game.

What functionality did the installed app provide?

Users who installed the 42 MB file reported finding a contacts-style interface with AI avatars or a chat app with prepared responses. PiunikaWeb and Android Authority noted these findings. No evidence of password theft, banking trojans, or remote control capabilities was found in the available reports.

Why is the download count misleading?

The 100,000+ figure reflects total installs since the app’s original launch as a game. It does not prove that 100,000 users installed the version with Chrome branding. The rebranding occurred in late September, meaning most downloads likely happened under the Ball Bounce identity.

What operational risks does this pose?

The primary risk is the bait-and-switch tactic at the listing level. Attackers can alter an app’s outward identity while keeping its package ID and distribution history. This makes simple name checks insufficient for verifying software integrity on managed devices.

Questions to ask your suppliers

Security teams should ask suppliers whether their app distribution policies account for post-launch identity changes. Verify if endpoint management tools monitor package identifiers rather than just display names. Determine who receives alerts when a trusted vendor’s app is flagged for impersonation. Ensure procurement teams understand that app store presence does not guarantee continuous legitimacy. Check if your organization has a process to audit installed apps against known package signatures.

What to do and how to stay safe: Google Play

• Audit installed applications on managed devices using package identifiers, not just app names or icons.
• Monitor for unexpected changes in app descriptions or developer names in your app management console.
• Educate users to verify the developer name (Google LLC) before installing browser software.
• Once the vendor provides an update, review any new detection signatures for similar impersonation tactics.

Step-by-step guide: Browser Security Settings for Small Business Teams

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Was malware found in the fake Chrome app?

No reviewed report supplied evidence of browser password theft, remote control, or hidden banking screens in this app.

Who developed the counterfeit application?

The developer name listed was Hizbartech, rather than Google LLC.

Is the app still available on Google Play?

Subsequent reporting indicates Google removed the application after it was flagged by users and researchers.