A counterfeit version of WhatsApp Messenger has amassed more than 500,000 downloads on the Google Play Store, according to reports from The Verge and Android Authority, in the latest in a string of imposter apps slipping past the marketplace's automated review systems. The fake listing was still live at the time of writing, and Google did not immediately respond to a request for comment.

The clone is published by a developer operating under the name "Agment Assets sallu," an account that, as of the reporting, has nothing else listed on the Play Store. According to The Verge, the fraudulent listing copies the genuine app's icon, screenshots and descriptive text almost verbatim — the standard playbook for storefront impersonation, designed to make a hurried downloader see no difference at all.

A Sponsored Slot Above the Real Thing

Perhaps the most troubling detail concerns placement rather than disguise. A user on Reddit reported seeing the fake WhatsApp appear in a sponsored slot positioned above the legitimate WhatsApp listing in search results. That is a significant escalation: a sponsored position carries Google's implicit endorsement, and users are considerably more likely to tap a paid placement at the top of a results page than they are to scroll past it.

"A user on Reddit says they're seeing a fake version of WhatsApp in a 'sponsored' slot above the real version." — The Verge

The mechanism by which an imposter secures a paid placement is not fully clear from the reporting, but the outcome is: the app reached half a million installs, a scale that suggests the fraud was neither brief nor marginal. As Android Authority bluntly put it, "After Chrome, we now have a WhatsApp dupe on the Play Store with 500,000+ downloads."

A Pattern, Not an Incident

The WhatsApp clone is not an isolated failure. Earlier in the same week, a fake Chrome app carrying more than 100,000 downloads was spotted on the Play Store. Coverage from PiunikaWeb noted that the Chrome imposter was subsequently removed — an update appended to the original report — which frames the WhatsApp case as a recurring cycle rather than a one-off lapse: an imposter appears, accumulates tens or hundreds of thousands of installs, is publicly identified, and is eventually pulled.

Coverage of the two incidents across outlets has differed in emphasis. The Verge focused tightly on the mechanics of the deception and the sponsored placement, treating it as a storefront-integrity story. Android Authority framed it comparatively, positioning the WhatsApp dupe as the second shoe to drop after the Chrome imposter. Other syndicated coverage, meanwhile, has leaned hard into the security angle — pushing headlines about spyware and malicious apps "secretly tracking users" — reflecting a broader audience anxiety about what these clones actually do once installed.

What's Actually at Stake

That anxiety is not unfounded. Fake messaging apps are prized by malicious actors precisely because of what a messaging app is trusted to hold: contact lists, phone numbers, message history and, in many cases, the SMS verification codes used to secure other accounts.

• Credential and OTP theft: A convincing clone can harvest login credentials or intercept one-time passcodes for other services.
• Contact-list exfiltration: Messaging apps routinely request broad address book permissions, handing an imposter a ready-made social graph.
• Surveillance capability: Malicious builds can embed tracking components that report device and location data to third parties.
• Downstream fraud: Compromised accounts are commonly repurposed for scams targeting the victim's own contacts.

Whether this particular clone is actively malicious has not been established in the reporting. But the reputational and practical harm does not require a confirmed payload. An app bearing WhatsApp's branding and sitting above WhatsApp in a Google search bar erodes the fundamental promise of an app store: that what you download is what you asked for.

Why Store Moderation Keeps Failing

Google's Play Store hosts millions of apps and relies heavily on automated scanning, developer identity checks and post-hoc takedowns. That model is built for scale, not for adversarial persistence. Attackers publish under throwaway developer names, mirror assets from legitimate listings, and occasionally manage to buy visibility — all before human review catches up. The "Agment Assets sallu" account having no other published apps is a red flag that manual review would presumably have caught, and it points to how much weight Google places on signals that can be gamed.

There is also an economic asymmetry. For Google, a single imposter is a rounding error in a catalogue of millions. For a user who installs it, it may be the single most consequential app on their phone.

What Users Can Do

Until the listing is removed, basic hygiene offers the only real protection. Verify the developer name, not the app name: the real WhatsApp is published by WhatsApp LLC, and the developer line sits directly beneath the app title. Check install counts and review patterns for anomalies. Avoid tapping sponsored results when searching for a well-known app, and prefer navigating to a listing from a trusted link. Finally, audit what you have already installed — a clone that reached 500,000 downloads has almost certainly found its way onto phones whose owners believe they downloaded the genuine article.

The larger question, and the one neither Google nor the reporting has yet answered, is how a fake app with half a million installs continued to appear in a paid position above the real one it was impersonating.