Fake call logs, real payments: How CallPhantom tricks Android users

ESET researchers uncovered fraudulent apps on Google Play that claim to provide the call history “for any number” and had been downloaded more than seven million times before being taken down

There’s an app for everything nowadays… right? Well, looking up call records for a phone number of choice is not one of those things, as potentially millions of Android users found out after paying for app subscriptions promising just that.

The offending apps, which we named CallPhantom based on their false claims, purport to provide access to call histories, SMS records, and even WhatsApp call logs for any phone number. To unlock this supposed feature, users are asked to pay – but all they get in return is randomly generated data.

Our investigation identified 28 such fraudulent apps available on the Google Play store, cumulatively downloaded more than 7.3 million times. As an App Defense Alliance partner, we reported our findings to Google, which removed all of the apps identified in this report from Google Play.

Key points of this blogpost:

• A new Android scam, CallPhantom, falsely claims to provide access to call logs, SMS records, and WhatsApp call history for any phone number in exchange for payment.

• We identified and reported 28 CallPhantom apps on Google Play, cumulatively downloaded more than 7.3 million times.

• Some CallPhantom apps sidestep Google Play’s official billing system, complicating victims’ refund efforts.

Investigation

In November 2025, we came across a Reddit post discussing an app named Call History of Any Number, found on Google Play. The app, shown in Figure 1, claims that it can retrieve the call history of any phone number supplied by the user. It was published under the developer name Indian gov.in, but the app has no real association with the Indian government.

Figure 1. Call History of Any Number app on Google Play

Unsurprisingly, our analysis showed that the “call history” data provided by this app is entirely fabricated – the app generates random phone numbers and matches them with fixed names, call times, and call durations, which were embedded directly in the code, as shown in Figure 2. This fake data is then presented to victims – but only after payment.

Figure 2. Hardcoded call log data used by the app

A screenshot of the fabricated call history data was even included in the app’s listing, presented as a demonstration of the app’s functionality, as shown in Figure 3.

Figure 3. Screenshots from Google Play seemingly demonstrating the fraudulent app’s functionality; the logs are randomly generated from hardcoded data

Further research revealed additional, related apps available on the Play Store – 28 CallPhantom apps altogether. We reported the full set of fraudulent apps to Google on December 16^th, 2025. At the time of publication, all the reported apps have been removed from the store.

Despite visual differences, which can be seen in Figure 4 and Figure 5, the purpose of the apps is identical: generate fake communication data and charge victims for access. The table in the Analyzed CallPhantom apps section lists each app along with its key details, including the download count.

Figure 4. Examples of CallPhantom apps found on the Play Store

Figure 5. Examples of CallPhantom initial screens

Campaign overview

The CallPhantom apps we found on Google Play mainly targeted Android users in India and the broader Asia‑Pacific region. Many of the apps came with India’s +91 country code preselected and support UPI, a payment system used primarily in India.

The apps had garnered numerous negative reviews, with victims reporting that they were scammed and never received the promised data, as can be seen in Figure 6.

Figure 6. Negative reviews for one of the fraudulent apps

It is not clear how the apps were distributed or promoted. Presumably, by seemingly offering insight into private information, the scammers successfully took advantage of people’s curiosity. Combined with a few glowing (fake) reviews, it might have seemed like an intriguing offer.

CallPhantom overview

In our investigation, we identified two main clusters of these fraudulent apps.

The apps in the first cluster contain hardcoded names, country codes, and templates in their code, as shown in Figure 7. These are combined with randomly generated phone numbers and shown to the user as partial “results”. To view the full (fake) history, the victim has to pay.

Figure 7. Code responsible for generating messages

The apps in the second cluster ask users to enter an email address where the “retrieved” call history would supposedly be delivered, as seen in the screenshots in Figure 8. No data generation occurs until after payment; users have to pay or subscribe before any email would supposedly be sent.

Figure 8. CallPhantom requests the user’s email address where call logs would supposedly be delivered

In general, CallPhantom apps have a simple user interface and do not request any intrusive or sensitive permissions – they don’t need to. Coincidentally, they do not contain any functionality capable of retrieving real call, SMS, or WhatsApp data.

In the CallPhantom apps we analyzed, we saw three different payment methods used, the latter two of which are in violation of Google Play’s payments policy.

First, some of the apps relied on subscriptions via Google Play’s official billing system. This is required of apps offering in-app purchases, per Google Play’s payments policy; such purchases are covered by Google’s refund protection.

Second, some of the apps relied on payments via third-party apps that support UPI. For these third-party payment apps, CallPhantom apps either included hardcoded URLs or fetched the URLs dynamically from a Firebase realtime database, meaning the payment account could be changed at any time by the operator.

Third, in some cases, payment card checkout forms were included directly in the CallPhantom apps.

Examples of the payment methods can be seen in Figure 9.

Figure 9. Various payment options used by CallPhantom apps

In one case, we observed an additional tactic used to coax the user into paying: if the user exited the app without payment, the app displayed deceptive alerts styled as new emails claiming that the call history results had arrived – see Figure 10. Clicking the notification led straight to a subscription screen.

Figure 10. Deceptive notification displayed by CallPhantom to persuade users to subscribe

The fees requested for the fake service differ widely across the apps. The apps also appear to offer different subscription packages, such as weekly, monthly, or yearly services, with the highest requested price sitting at US$80. For the lowest “subscription tier”, the average requested price was €5.

What to do if you have been scammed

In general, subscriptions purchased through the official Google Play billing system can be canceled in the Play Store app by tapping your profile icon, navigating to Payments & subscriptions → Subscriptions, selecting the active subscription, and tapping Cancel subscription. Google explains the full process on its Cancel, pause, or change a subscription on Google Play page.

For the 28 apps described in this blogpost, existing subscriptions have been canceled when the apps were removed from Google Play.

In some cases, refunds for Google Play purchases are possible. Google may issue a refund depending on the time since purchase, the type of item, and its refund policy. In general, requests must be made within the allowed refund window as described on Google’s support page.

If the purchase was made outside Google Play – for example, by entering payment card details inside the app or by paying through third‑party services – then Google cannot cancel the subscription or issue a refund, and users have to contact the payment provider or the app developer directly.

Conclusion

We identified a new cluster of fraudulent Android apps on Google Play that collectively amassed over 7.3 million downloads before being taken down upon notification by ESET. These apps, which we collectively named CallPhantom, falsely promise to retrieve call logs, SMS records, and WhatsApp call history for any phone number, a technically impossible claim designed solely to exploit people’s curiosity and mislead them into paying.

Many of the apps circumvented Google Play’s official billing system, pushing users toward third‑party payments or direct card entry, complicating refund efforts and exposing victims to financial risk.

Our analysis revealed that the “results” shown to victims are entirely fabricated, often using hardcoded Indian numbers, predefined names, and generated timestamps disguised as real communication data.

Users who subscribed via official Google Play billing may be eligible for refunds under Google’s refund policies. Purchases made via third‑party payment apps or through direct payment card entry cannot be refunded by Google, leaving users dependent on external payment providers or developers.

Analyzed CallPhantom apps

App name	Package name	Number of downloads
Call history : any number deta	calldetaila.ndcallhisto.rytogetan.ynumber	3M+
Call History of Any Number	com.pixelxinnovation.manager	1M+
Call Details of Any Number	com.app.call.detail.history	1M+
Call History Any Number Detail	sc.call.ofany.mobiledetail	500K+
Call History Any Number Detail	com.cddhaduk.callerid.block.contact	500K+
Call History Of Any Number	com.basehistory.historydownloading	500K+
Call History Of Any Numbers	com.call.of.any.number	100K+
Call History Of Any Number	com.rajni.callhistory	100K+
Call History Any Number Detail	com.callhistory.calldetails.callerids.callerhistory.callhostoryanynumber.getcall.history.callhistorymanager	100K+
Call History Any Number Detail	com.callinformative.instantcallhistory.callhistorybluethem.callinfo	100K+
Call History Any Number Detail	com.call.detail.caller.history	100K+
Call History Any Number Detail	com.anycallinformation.datadetailswho.callinfo.numberfinder	100K+
Call History Any Number Detail	com.callhistory.callhistoryyourgf	50K+
Call History Any Number	com.calldetails.smshistory.callhistoryofanynumber	50K+
Call History Any Number Detail	com.callhistory.anynumber.chapfvor.history	50K+
Call History of Any Number	com.callhistory.callhistoryany.call	50K+
Call History Any Number Detail	com.name.factor	50K+
Call History Of Any Number	com.getanynumberofcallhistory.callhistoryofanynumber.findcalldetailsofanynumber	50K+ might be error
Call History Of Any Number	com.chdev.callhistory	10K+
Phone Call History Tracker	com.phone.call.history.tracker	10K+
Call History- Any Number Deta	com.pdf.maker.pdfreader.pdfscanner	10K+
Call History Of Any Number	com.any.numbers.calls.history	10K+
Call History Any Number Detail	com.callapp.historyero	1K+
Call History - Any Number Data	all.callhistory.detail	500+
Call History For Any Number	com.easyranktools.callhistoryforanynumber	100+
Call History of Numbers	com.sbpinfotech.findlocationofanynumber	100+
Call History of Any Number	callhistoryeditor.callhistory.numberdetails .calleridlocator	50+
Call History Pro	com.all_historydownload.anynumber.callhistorybackup	50+

IoCs

A comprehensive list of indicators of compromise (IoCs) and samples can be found in our GitHub repository.

Files

SHA-1	Filename	Detection	Description
799BB5127CA54239D3D4A14367DB3B712012CF14	all.callhistory.detail.apk	Android/CallPhantom.K	Android CallPhantom.
56A4FD71D1E4BBA2C5C240BE0D794DCFF709D9EB	calldetaila.ndcallhisto.rytogetan.ynumber.apk	Android/CallPhantom.M	Android CallPhantom.
EC5E470753E76614CD28ECF6A3591F08770B7215	callhistoryeditor.callhistory.numberdetails.calleridlocator.apk	Android/CallPhantom.F	Android CallPhantom.
77C8B7BEC79E7D9AE0D0C02DEC4E9AC510429AD8	com.all_historydownload.anynumber.callhistorybackup.apk	Android/CallPhantom.G	Android CallPhantom.
9484EFD4C19969F57AFB0C21E6E1A4249C209305	com.any.numbers.calls.history.apk	Android/CallPhantom.L	Android CallPhantom.
CE97CA7FEECDCAFC6B8E9BD83A370DFA5C336C0A	com.anycallinformation.datadetailswho.callinfo.numberfinder.xapk	Android/CallPhantom.B	Android CallPhantom.
FC3BA2EDAC0BB9801F8535E36F0BCC49ADA5FA5A	com.app.call.detail.history.apk	Android/CallPhantom.N	Android CallPhantom.
B7B80FA34A41E3259E377C0D843643FF736803B8	com.basehistory.historydownloading.xapk	Android/CallPhantom.O	Android CallPhantom.
F0A8EBD7C4179636BE752ECCFC6BD9E4CD5C7F2C	com.call.detail.caller.history.xapk	Android/CallPhantom.C	Android CallPhantom.
D021E7A0CF45EECC7EE8F57149138725DC77DC9A	com.call.of.any.number.apk	Android/CallPhantom.Q	Android CallPhantom.
04D2221967FFC4312AFDC9B06A0B923BF3579E93	com.callapp.historyero.apk	Android/CallPhantom.E	Android CallPhantom.
CB31ED027FADBFA3BFFDBC8A84EE1A48A0B7C11D	com.calldetails.smshistory.callhistoryofanynumber.apk	Android/CallPhantom.Q	Android CallPhantom.
C840A85B5FBAF1ED3E0F18A10A6520B337A94D4C	com.callhistory.anynumber.chapfvor.history.xapk	Android/CallPhantom.J	Android CallPhantom.
BB6260CA856C37885BF9E952CA3D7E95398DDABF	com.callhistory.calldetails.callerids.callerhistory.callhostoryanynumber.getcall.history.callhistorymanager.apk	Android/CallPhantom.S	Android CallPhantom.
55D46813047E98879901FD2416A23ACF8D8828F5	com.callhistory.callhistoryany.call.apk	Android/CallPhantom.T	Android CallPhantom.
E23D3905443CDBF4F1B9CA84A6FF250B6D89E093	com.callhistory.callhistoryyourgf.apk	Android/CallPhantom.D	Android CallPhantom.
89ECEC01CCB15FCDD2F64E07D0E876A9E79DD3CE	com.callinformative.instantcallhistory.callhistorybluethem.callinfo.xapk	Android/CallPhantom.B	Android CallPhantom.
8EC557302145B40FE0898105752FFF5E357D7AC9	com.cddhaduk.callerid.block.contact.xapk	Android/CallPhantom.U	Android CallPhantom.
6F72FF58A67EF7AAA79CE2342012326C7B46429D	com.easyranktools.callhistoryforanynumber.apk	Android/CallPhantom.H	Android CallPhantom.
28D3F36BD43D48F02C5058EDD1509E4488112154	com.getanynumberofcallhistory.callhistoryofanynumber.findcalldetailsofanynumber.xapk	Android/CallPhantom.D	Android CallPhantom.
47CEE9DED41B953A84FC9F6ED556EC3AF5BD9345	com.chdev.callhistory.xapk	Android/CallPhantom.V	Android CallPhantom.
9199A376B433F888AFE962C9BBD991622E8D39F9	com.name.factor.apk	Android/CallPhantom.P	Android CallPhantom.
053A6A723FA2BFDA8A1B113E8A98DD04C6EEF72A	com.pdf.maker.pdfreader.pdfscanner.apk	Android/CallPhantom.W	Android CallPhantom.
4B537A7152179BBA19D63C9EF287F1AC366AB5CB	com.phone.call.history.tracker.apk	Android/CallPhantom.I	Android CallPhantom.
87F6B2DB155192692BAD1F26F6AEBB04DBF23AAD	com.pixelxinnovation.manager.apk	Android/CallPhantom.X	Android CallPhantom.
583D0E7113795C7D68686D37CE7A41535CF56960	com.rajni.callhistory.apk	Android/CallPhantom.Y	Android CallPhantom.
45D04E06D8B329A01E680539D798DD3AE68904DA	com.sbpinfotech.findlocationofanynumber.xapk	Android/CallPhantom.A	Android CallPhantom.
34393950A950F5651F3F7811B815B5A21F84A84B	sc.call.ofany.mobiledetail.apk	Android/CallPhantom.Z	Android CallPhantom.

Network

IP	Domain	Hosting provider	First seen	Details
34.120.160[.]131	call-history-7cda4-default-rtdb.firebaseio[.]com call-history-ecc1e-default-rtdb.firebaseio[.]com	Google LLC	2025‑05‑14	CallPhantom C&C server.
34.120.206[.]254	ch-ap-4-defaultrtdb.firebaseio[.]com chh1-ac0a3-default-rtdb.firebaseio[.]com	Google LLC	2025‑04‑17	CallPhantom C&C server.

MITRE ATT&CK techniques

This table was built using version 18 of the MITRE ATT&CK framework.

Tactic	ID	Name	Description
Command and Control	T1437.001	Application Layer Protocol: Web Protocols	CallPhantom uses Firebase Cloud Messaging for C&C communication.
Impact	T1643	Generate Traffic from Victim	CallPhantom uses Firebase Cloud Messaging for C&C communication.