In an investigation published October 23, 2026, McAfee said RewaFake apps used remote settings to open web pages inside a browser with its address bar hidden. The campaign impersonated familiar services in Google Play, and McAfee attributed more than 1,900 apps to it, with detections on more than 500,000 devices across more than 190 countries.
How RewaFake redirected users
McAfee said the apps shared code and contacted the same remote server. A configuration field called qureka_url supplied the destination, which each app opened in an embedded browser or a Chrome custom tab. With the address bar hidden, the page’s web address was not visible in that browser interface.
The listings posed as apps connected to brands including CapCut, Roblox, Zelle, PayPal, Netflix, Xbox Game Pass, Siri, and iMessage. McAfee estimated that operators published 20 to 25 new apps a day, based on publication patterns. It also named the United States among the countries with the largest concentrations of affected devices.
What McAfee observed on the redirected pages
McAfee reported seeing advertising and gambling-style quizzes at the destinations. Some ads led to subscription pages requesting payment-card details. McAfee described phishing and credential theft as possible uses of the redirect mechanism, but did not report seeing credentials stolen in its tests.
McAfee said the apps it analyzed did not exploit Android vulnerabilities or request dangerous permissions. The reported approach relied on deceptive listings and remotely selected web pages. McAfee classified the app family as a medium-risk threat in McAfee Mobile Security.
After disclosing its findings to Google, McAfee said Google removed all the apps McAfee had identified.
What to check before installing an app
McAfee recommends checking the developer’s identity rather than relying on a familiar name or logo. A high download count is not proof that a listing is legitimate. For financial apps, McAfee advises getting the app through the bank’s own website or a verified link.
