In popular culture, access to an illicit gambling den is as easy as stumbling into the right shop and saying the password — or greasing some palms. Apple’s App Store apparently has a real-life parallel: today, app developer Kosta Eleftheriou discovered a terrible kiddie game that’s actually a front for gambling websites.

The secret password isn’t one you’d be likely to guess: you have to be in the right country —or pretend to be in the right country using a VPN.

But then, instead of launching an ugly monkey-flipping endless runner game filled with typos and bugs, the very same app launches a casino experience:

The app, “Jungle Runner 2k21,” has already disappeared from the App Store, presumably thanks to publicity from Gizmodo and Daring Fireball, who each wrote about Eleftheriou’s finding earlier today.

It’s not the only one, though: the same developer, “Colin Malachi,” had another incredibly basic game on the App Store called “Magical Forest – Puzzle” that was also a front for gambling. I tried them both myself, and here’s some visual evidence:

Here’s what Magical Forest looked like when you opened it from the United States:

I accessed them from a VPN server in Turkey; While Daring Fireball notes that users in other non-US countries like Italy also seem to have been able to access the gambling sites, I tried them with a number of other locations including Italy without success.

Unlike the multi-million dollar App Store scams that Eleftheriou uncovered earlier this year, it’s not hard to see why Apple’s App Store review program might have missed these — they largely look like your typical shovelware if you don’t know the trick, with only a handful of tells… like the fact that Jungle Runner uses a Pastebin for its privacy policies:

It’s not necessarily clear to me that they’d be violating very many of Apple’s App Store policies, either. Gambling apps are permitted by Apple, as long as they’re geo-restricted to regions where that gambling is permitted by law, and you could maybe argue that’s exactly what this developer did by checking your IP address. But I imagine Cupertino would frown on a gambling app masquerading as a kid’s game either way — and Eleftheriou suggests the gambling sites may be scamming people out of money, too.

Apple didn’t immediately reply to a request for comment.

https://www.theverge.com/2021/4/15/22386533/ios-app-scam-jungle-runner-magical-forest-apple-kosta