Demo workspaceSample data for Kestrel Pay, a fictional bank. Nothing here is a live customer feed.
Exit demoStart your workspace

Signal workspace

Unofficial wallet app requests SMS and contact permissions.

Listing copies the product screenshots under an unrelated publisher and asks for interception-grade permissions.

Case queue
Vantablue StudioGoogle PlayFake appconfirmed

Observed content

Kestrel Pay Wallet Pro. Faster balance checks, instant transfers, and a live spending view the official app does not offer yet. Requires SMS, contacts, and accessibility access so the wallet can sync your account automatically and confirm transfers without extra steps.
2,140 installs31 reviewsrated 4.6Open source

Why we flagged it

Publisher is not Kestrel Financial Ltd, store imagery is copied from the official listing, and the requested permissions would expose one-time passcodes.

91

severity

Relevance
96%
First seen
38 min ago
Check version
sentinel-threat-v1

Signs of harm

credential-requestsensitive-permissionsunofficial-publisher

Evidence

Each capture is hashed on write. The digest is what makes the record checkable later.

4 retained
  • Listing metadataapify-listing12 KB · 12 Mar 2026, 13:43 UTC

    sha256bed072b660607decf482c06c564e5380adc8fcb8623a29cd56434713faf7d633

  • Screenshotcrawl4ai-screenshot491 KB · 12 Mar 2026, 13:44 UTC

    sha256fdb3403f7fcd1a0fb8377cecd7c78d88497034e20ea5984f893197ccfcdadf1f

  • Screenshotcrawl4ai-screenshot336 KB · 12 Mar 2026, 13:46 UTC

    sha2568538d2f9b9edf36fcc48697ee670ad984859054e4c1337a32e4b3a475c325774

  • Vision analysisvision-analysis4 KB · 12 Mar 2026, 13:47 UTC

    sha25649b414f194bd48329db5f149d76a04bc1421bd321d2dc3738a2ae379eac1303b

Case brief

sentinel-dossier-v1

pending

Short summary

A Google Play listing published by Vantablue Studio reproduces the Kestrel Pay store imagery and product name under a publisher with no relationship to Kestrel Financial Ltd. The listing requests SMS, contacts, and accessibility permissions, which together would allow an installed build to read one-time passcodes. The listing has about 2,140 installs.

Proof used

  • Store listing metadata captured 12 Mar 2026, publisher recorded as Vantablue Studio.
  • Full store page screenshot showing product imagery matched to the official reference asset set.
  • Permission sheet screenshot recording the SMS, contacts, and accessibility requests.
  • Vision analysis returning a logo match against the registered wordmark, with the similarity caveat retained.

Where to report it

Google Play impersonation and intellectual-property form, filed by the brand owner of record. A human should confirm the current form and the publisher identity before submission.

What to do next

File the platform report with the four retained captures attached, and notify support so inbound queries about the unofficial build can be answered consistently.

Sentinely provides evidence and recommendations only. The recipient decides and executes any report, enforcement, or legal action.

Decision trail

Append-only. Every status change records who and why.

  1. detectedStore listing matched the reference asset set at 0.96.Collector · System · 38 min
  2. detecteddocumentedListing metadata, store page, and permission sheet captured.Priya Raghunathan · Analyst · 32 min
  3. documentedconfirmedPublisher has no relationship to Kestrel Financial Ltd, and the SMS plus accessibility permissions together would expose one-time passcodes on an installed build.Priya Raghunathan · Analyst · 26 min