Fake Alexa setup app climbs Apple’s App Store charts

There’s a fake Amazon Alexa setup tool for iOS masquerading as a legitimate app, and it’s climbing the charts alarmingly quickly. One World Software’s duplicitously named “Setup for Amazon Alexa” — it went live this week — is the sixth most downloaded app in the Apple App Store’s “Utilities” category and the 60th overall in “Top Free,” and it has managed to rack up over 9,400 ratings to date.

The app itself is suspiciously barebones, with a fake setup flow that asks users to supply their IP address, a device serial number, and a “name.” But judging by the reviews, it has managed to hoodwink quite a few Alexa device owners so far, many of whom have expressed frustration over its “complicated setup” and “instability.”

“This app doesn’t work. I got this as a present,” wrote one user. “I’m returning and getting something else.”

To make matters worse, One World Software’s privacy policy gives it free rein to collect a worrisome amount of personal information about the folks using its apps, including (but not limited to) “IP address, browser information, referring/exit pages and URLs, clickstream data … domain names, landing pages, page views, cookie data … mobile device type, mobile device IDs … and location data.” It furthermore discloses that the company might track users’ location and movements to “monitor the effectiveness of [its] service[s] and … marketing campaigns.”

While Apple polices its App Store, it’s not the first time an illegitimate app has slipped through the cracks. In September, 9to5Mac reported that the top paid utility in the Mac App Store — Adware Doctor, which has since been removed — secretly logged users’ browser history and sent the data to a server in China. More recently, security researchers revealed that “multiple apps” posing as fitness-tracking tools were using Apple’s Touch ID feature to steal money from iOS users.

And the Alexa scam app’s rise isn’t terribly surprising, given the sheer volume of Alexa-enabled device sales this holiday season; “Setup for Amazon Alexa” is no doubt a top search term. Amazon this week revealed that shipments of the Echo Dot, Alexa Voice Remote, and Echo were up substantially from this fiscal quarter last year, and the company pegged sales of Amazon Fire TV, Fire Tablet, and Kindle products in the “millions.”

As of publication time, neither “Setup for Amazon Alexa” nor One World Software’s other questionable apps — “Marketplace – Buy/Sell” and “Any Font for Instagram” — had been pulled from the App Store. We’ve reached out to Amazon and Apple and will update this post if we hear back.

Updated 12/27/18 at 8:02 p.m. Pacific: The app has been removed from the App Store, an Amazon spokesperson confirmed to VentureBeat.