Bitdefender Labs says Google Play’s Early Access program is quietly sheltering thousands of deceptive apps, and the scheme works precisely because the window is unsupervised.
Early Access lets developers ship unfinished builds. While an app sits there, users cannot post public ratings or reviews. Bitdefender found fake casino and reward games, misleading utilities, and apps that lean on recognizable third-party trademarks, often pushed through TikTok and Facebook ads that use AI-generated deepfakes of celebrities.
For a security team the problem is not a wasted lunch break. The report describes utilities requesting permissions far beyond their stated purpose, behavior that could turn an employee’s Android device into a foothold.
The blind spot is structural. Reviews are the main crowd-sourced warning signal on the store, and during Early Access that signal is switched off. Attackers can bank installs and reputation before anything surfaces.
Bitdefender’s advice is straightforward. Treat Early Access titles as untrusted in mobile device management policy, block or review installs from unknown developers, and weigh unusual permission requests more heavily than star ratings. Employees chasing a promised reward are exactly the audience these apps want.
Google has not said whether it plans to change the program. Until it does, the safest assumption is that an unreviewed listing is an unchecked one.
