CTM360 reveals Playmasquered Party

Table of Contents

Overview of PlayPraetor’s masquerade party variations

CTM360 has identified a much larger scope of the ongoing Play Praetor campaign. What started with over 6,000 URLs of very specific bank attacks has grown to over 16,000 with multiple variants. The study is ongoing and is expected to be discovered in the next few days.

Just like before, all newly discovered play spoofing mimics a legitimate app list, cheating users to install malicious Android applications and publishing sensitive personal information. Although these cases initially appeared to be in quarantine, further investigation reveals a globally coordinated campaign poses a serious threat to the integrity of the Play Store ecosystem.

The evolution of threats

This report extends previous research with PlayPraetor studies, highlighting the discovery of five newly identified variants. These variations reveal an increase in campaign sophistication in terms of attack technology, distribution channels and social engineering tactics. The continuous evolution of PlayPraetor demonstrates adaptability and sustained targeting of the Android ecosystem.

Variant-specific targeting and regional focus

In addition to the original PlayPraetor Banking Trojan horse, there are 5 new variations –fish, Mouse, PWA, phantomand Veil– Identified. These variations are distributed through fake websites that are very similar to the Google Play Store. Although they share common malicious behavior, each variant exhibits unique characteristics tailored to a particular area and use case. The target areas include the Philippines, India, South Africa and a variety of global markets.

These variants employ a combination of qualification phishing, remote access capabilities, installation of deceptive web apps, abuse of Android accessibility services, and stealth techniques that hide malicious activities behind legitimate branding.

Attack targets and industry focus

Each variant has unique features and regional targeting, but the common theme for all PlayPraetor samples is Financial Sector. The threat actors behind these variations attempt to steal banking qualifications, credit/debit card details, digital wallet access, and in some cases attempt to carry out fraudulent transactions by transferring funds to a Mule account. These monetization strategies demonstrate well-organized operations focused on economic benefits.

Variant overview and detection insights

5 new variants –fish, Mouse, PWA, phantomand Veil– Currently under active investigation. Some variants have checked detection statistics, while others are still being analyzed. A comparison table summarizing these variants, their features, and regional targets is included in the following sections, along with a detailed technical analysis.

Variant name	function	explanation	Target industry	Detected cases (approx.)
PlayPraetor PWA	Deceptive Progressive Web App	Install fake PWAs that mimic legal apps, create shortcuts on your home screen, and trigger permanent push notifications to induce interactions.	Technology industry, finance industry, gaming industry, gambling industry, e-commerce industry	5400+
PlayPraetor Phish	WebView Phishing	A WebView-based app that launches a phishing web page to steal user credentials.	Finance, Communications, Fast Food Industry	1400+
PlayPraetor Phantom	Stealth Persistence and Command Execution	Abuse Android Accessibility Services for permanent control. Run quietly, remove data, hide icons, block uninstalls, and pause as a system update.	Financial, Gambling, Technology	These variants are currently under investigation to determine their exact identity.
PlayPraetor rat	Remote Access Trojan Horse	Gives attackers full remote control of infected devices, allowing them to monitor, theft and manipulate data.	Financial industry
PlayPraetor Veil	Regional and invitation-based phishing	Use legitimate branding to impersonate yourself, restrict access via invitation codes, impose local restrictions, avoid detection among local users, and increase trust.	Financial and Energy Industry

Geographical distribution and targeting patterns

Analysis of CTM360 shows that PlayPraetor variants are globally distributed, but certain strains exhibit a broader outreach strategy than others. especially, Phantom-ww Variant stands out in its global targeting approach. In this case, threat actors can spoof as a widely recognized application with global appeal, throw wider nets, and increase the likelihood of victim involvement in multiple regions.

Among the variants identified, PWA Variants emerged as the most common and were detected in a wide range of geographical regions. That reach span South America, Europe, Oceania, Central Asia, South Asiaand part of African Continenthighlights its role as the most widespread variant within the PlayPraetor campaign.

Other variants showed more specific regional targeting. fish The variants were distributed across multiple regions, although slightly less saturated than PWA. in contrast, Mouse Variants showed significant concentrations of activity South Africaproposes a region-specific focus. Similarly, Veil Variants were mainly observed in US Select African countriesreflects a more targeted deployment strategy.