ESET said it identified 28 Android apps on Google Play that charged users for fabricated communications records while claiming they could retrieve call histories, SMS records and WhatsApp call logs for any phone number.
The security company named the cluster CallPhantom and said the apps had accumulated more than 7.3 million downloads. ESET reported the full set to Google on December 16, 2025, and said all 28 had been removed by the time it published its findings.
The apps mainly targeted Android users in India and the broader Asia-Pacific region, ESET said. Many preselected India’s +91 country code and supported UPI, a payment system used primarily in India.
How the apps fabricated records
ESET began investigating in November 2025 after researchers encountered a Reddit discussion about an app called Call History of Any Number. It was listed under the developer name “Indian gov.in,” but ESET said it had no association with the Indian government.
The company’s analysis found that the app generated random phone numbers and combined them with names, call times and call durations embedded in its code. The fabricated records were presented as genuine call history after payment.
Across the wider cluster, ESET identified two main approaches. One group combined hardcoded names, country codes and templates with randomly generated phone numbers, showing partial results before requiring payment for the full fabricated history. Another group requested an email address for supposed delivery of the records and required payment or a subscription before generating any data.
The analyzed apps generally had simple interfaces and did not request intrusive or sensitive permissions, ESET said. Its analysis found no functionality capable of retrieving real call, SMS or WhatsApp data.
Payments, subscriptions and refunds
ESET identified three payment methods: subscriptions through Google Play’s billing system, payments through third-party apps supporting UPI, and card checkout forms embedded directly in the apps. The subscription packages included weekly, monthly and yearly options. The highest requested price ESET observed was US$80, while the average requested price for the lowest subscription tier was €5.
For these 28 apps, ESET said existing subscriptions purchased through Google Play’s billing system were canceled when the apps were removed. Purchases through Google Play could be eligible for refunds under Google’s policies, but refunds were not guaranteed.
ESET said Google could not cancel subscriptions or issue refunds for purchases made outside its billing system, including direct card payments and third-party transactions. Those purchases required users to contact the payment provider or app developer. Google’s guidance also states that uninstalling an app does not itself cancel a subscription.
Apps identified by ESET
ESET identified the following 28 apps and package names. Several shared identical or nearly identical display names.
| App name | Package name |
|---|---|
| Call history : any number deta | calldetaila.ndcallhisto.rytogetan.ynumber |
| Call History of Any Number | com.pixelxinnovation.manager |
| Call Details of Any Number | com.app.call.detail.history |
| Call History Any Number Detail | sc.call.ofany.mobiledetail |
| Call History Any Number Detail | com.cddhaduk.callerid.block.contact |
| Call History Of Any Number | com.basehistory.historydownloading |
| Call History of Any Numbers | com.call.of.any.number |
| Call History Of Any Number | com.rajni.callhistory |
| Call History Any Number Detail | com.callhistory.calldetails.callerids.callerhistory.callhostoryanynumber.getcall.history.callhistorymanager |
| Call History Any Number Detail | com.callinformative.instantcallhistory.callhistorybluethem.callinfo |
| Call History Any Number detail | com.call.detail.caller.history |
| Call History Any Number Detail | com.anycallinformation.datadetailswho.callinfo.numberfinder |
| Call History Any Number Detail | com.callhistory.callhistoryyourgf |
| Call History Any Number | com.calldetails.smshistory.callhistoryofanynumber |
| Call History Any Number Detail | com.callhistory.anynumber.chapfvor.history |
| Call History of Any Number | com.callhistory.callhistoryany.call |
| Call History Any Number Detail | com.name.factor |
| Call History Of Any Number | com.getanynumberofcallhistory.callhistoryofanynumber.findcalldetailsofanynumber |
| Call History Of Any Number | com.chdev.callhistory |
| Phone Call History Tracker | com.phone.call.history.tracker |
| Call History- Any Number Deta | com.pdf.maker.pdfreader.pdfscanner |
| Call History Of Any Number | com.any.numbers.calls.history |
| Call History Any Number Detail | com.callapp.historyero |
| Call History – Any Number Data | all.callhistory.detail |
| Call History For Any Number | com.easyranktools.callhistoryforanynumber |
| Call History of Numbers | com.sbpinfotech.findlocationofanynumber |
| Call History of Any Number | callhistoryeditor.callhistory.numberdetails.calleridlocator |
| Call History Pro | com.all_historydownload.anynumber.callhistorybackup |
A separate impersonation campaign in Indonesia
In a separate investigation, Group-IB described fraud involving fake apps impersonating Indonesia’s Coretax platform. The company said the campaign used phishing websites, WhatsApp social engineering, malicious Android apps installed outside official stores and voice phishing to compromise devices and carry out unauthorized financial transfers.
Group-IB associated that activity with the GoldFactory threat cluster and identified malware from the Gigabud.RAT and MMRat families. Its findings concerned a separate campaign and did not establish a connection to CallPhantom.
