Introducing our new Canarytoken: the Fake App

We’re happy to announce our Canarytoken’s newest member: the Fake App Canarytoken. 

We’ve previously asked the question Would you know if your phone was hacked? and offered the Wireguard Canarytoken as a safeguard against it. But, as we install more apps on our phones, the attack surface (and incentive) for attackers continues to increase.

From journalists having their field notes read, to CEOs and presidents having their phones hacked, or the more prevalent scourge of intimate partner violence, more and more people are becoming targets of mobile hacks. Closer to home, with our reliance on apps for all our banking and finances, would you know if someone logged into your banking app without you knowing?

With our new Fake App Canarytoken, you’re able to download a fake app to your phone that looks like one of your real apps. If it’s ever opened, it’ll send out an alert.

(If you enabled location services when installing the fake app, we will grab its GPS coords and add them to the alert.)

Currently, you can make the app look like a dozen popular banks, mail apps, or password apps:

To create one, simply:

1. Head over to https://canarytokens.org and select the Fake App token
2. Select the app you want to imitate, provide an email where we’ll send the alert, and give a good reminder of what phone you installed the fake app on
3. Click create and install the app on your phone with the provided button

Now, if the fake app is ever opened on that phone, we’ll send you an alert.

Place the fake banking app on your home screen and let it sit there. Download it to your parent’s or grandparent’s phones and tell them to never touch it. If you ever get an alert, you know to contact them immediately.

It’s a simple idea and won’t catch every attack in the world, but, as with all our Canarytokens, we strongly believe that they increase your chances of detecting badness (plus like everything else at https://canarytokens.org, it’s completely free!).