The threat actor sets up these fake websites describing the application and linking to the Google Play Store to download it, like in the case of the malicious website, pikrpro[.]eu, seen below  Another sample website involved the use of a closely copied version of an existing website, with slight changes in the logo and options above the page.