Friday, August 14, 2026

TabControl Scam and the App Review Queue

Jeff Johnson:

Despite my history of uncovering App Store frauds, I rarely go looking for these things intentionally! They’re just so pervasive and obvious, they jump out at me. In this case, I was looking at the list of top paid Safari extensions in the Mac App Store, because two of my own extensions are currently on the list, when I noticed the TabControl Extension.

[…]

The Mac App Store “screenshot” for the app is not actually a screenshot at all. If you look closely, that’s not the real Safari: the toolbar elements are wrong. I suspect that the image was AI-generated.

[…]

Another thing you should note in the fake screenshot is the “4.9 out of 5” stars, giving the impression that this is the App Store user rating of the app.

[…]

These purported reviews, all but one of which is 5 stars, are all in English. Yet none of them is in the US App Store. […] If you’ve ever looked through App Store user reviews, it’s unusual to find this naming format. […] the dates on the reviews, such as “Mar 12,” predate the release of TabControl Extension in the App Store!

John Gruber:

God only knows what this obvious AI slop scam is doing with the data from users’ Safari tabs. It’s currently the 12th or 13th most popular Safari extension in the App Store.

Jeff Johnson:

Coincidentally, on the same day well-known developer Marco Arment complained on social media that his new, unreleased Mac App Store app had been waiting 12 days for review by Apple.

Arment ended up waiting on hold—listening to an odd choice of music—to talk to App Review, which I didn’t realize was an option. His Unforgetful app is now approved.

Johnson continued browsing Safari extensions in the store:

The apps’s privacy policy is again on Google Drive, but the developer website link goes to https://aee5e5015.app-ads-txt.com, a suspicious URL. This website is barren and simply redirects back to the App Store[…] Did App Store review ever bother to click the developer website link?

[…]

In addition to the 41 apps, each of which required at least one submission to App Store review, I count across those 41 apps at least 327 updates, almost all of which have the same generic description for what’s new in the update: "Bug fixes and performance improvements." So that’s at least 368 submissions to App Store review, most within the past 12 months, from a single developer. In other words, the developer is averaging almost one submission per day. We can count only approved submissions; we have no idea how many submissions by the developer were privately rejected by App Store review.

I get the impression that Apple is asleep at the wheel. Is anyone at Apple counting submissions per developer? How many is too many? How many resources is one developer allowed to consume?

[…]

You may view it as a noble, democratic ideal to treat every app developer the same, but in reality this is the path to the crApp Store, full of scams and slop.

John Voorhees:

There’s no doubt that there is spam on the App Store, but the way to remove it is to target the spammers, not new developers, students, and hobbyists looking to build their ideas. I know that being an indie developer isn’t an easy way to make a living, but erecting barriers to submitting apps is the surest way to starve Apple platforms of fresh, innovative ideas.

John Voorhees:

I’d like to see App Store spam cleaned up as much as anyone, but the way to do it isn’t preferring well-known developers and those who can afford to pay more for special treatment.

Marc Palmer:

I don’t agree with paid tiers either. However it feels like there should be a natural brake applied to new developers and new apps. It’s no big deal if your first app takes a week or two to review (often did 10y ago), and as it matures & receives meaningful updates in the store, turnaround increases as trust and “value” (active users?) builds up. Like “tarpitting” new accounts. I think limiting the # of new apps you can add per month to say 1 or 2 would also help…

Jeff Johnson:

I was a new App Store developer myself ten years ago. My previous article didn’t propose any new barriers for those groups. To be clear, I did imply that no developer, whether new or not, should have more than 40 apps and average a new App Store submission every day of the year. I’m not aware of any prominent developer who has that many. Apparently, checking just now, Microsoft by my count has 38 App Store apps between iOS and Mac, which is a lot but still less than the 41 apps of the developer I discussed in my previous article who is definitely not one of the largest software developers in the world along with Microsoft. I do think it’s reasonable for Microsoft to pay a significantly higher developer fee to have those 38 apps reviewed than a smaller developer pays to have one app reviewed by Apple.

[…]

My contention is that Apple is actually wasting its own resources treating every developer like a potential spammer or scammer, even the developers who are known to be trustworthy, and this wasting of resources makes it harder on everyone, including new developers, students, and hobbyists. App review is grossly inefficient, and it’s clearly failing to scale to the increase in App Store submissions. What I propose is not raising the gates but rather lowering the gates for developers who have already proven trustworthy, so that Apple can focus its review efforts where they’re most needed.

I’m not sure that paying more would help anything. If scams are profitable, surely it would be worth them paying more, and then we’re back to square one. And I don’t want to create another situation like App Store Search Ads where providing poor service makes the revenue numbers go up. But I like the general idea of considering the account’s history, e.g. the way the Discourse forum gradually increases trust over time. It should count for something if you have a long history of following the rules and submitting updates to a small number of apps on a reasonable schedule vs. frequent spamming of submissions that don’t even have real release notes. It would not be fair for Microsoft to be able to cut in line, but giving spammers equal access to the review queue means they’ll use more than their share of Apple’s resources. That also seems unfair. The current system encourages frequent submissions, which also increases the overall load on the reviewers. I think the incentives need to be changed somehow. Maybe each account should get a certain number of “fast” submissions per month or year, after which you can still submit but it goes into a lower priority queue.

William Gallagher:

Even among more legitimate-seeming apps, though, Apple is ignoring clear problems. In AppleInsider research, for instance, we found that many price tiers listed for the “Simply Piano” app bore no relation to what the developer actually charges.

[…]

You shouldn’t have to be the one to investigate apps you want to try. That is the future of third-party App Stores, and that is a future to be fought.

But that future is here with the first-party App Store we already have. And this inability to trust an App Store is here, right now, because Apple will not do what it keeps saying it is doing and what it is charging developers to do.

Previously:

Update (2026-08-20): Eric deRuiter:

I wonder if there is already a separate queue, not for Marco or other established indies, but for the huge companies: Facebook, Spotify, Google, etc.

Jeff Johnson:

Apparently the App Store developer in question saw my article in the news, because the fake App Store reviews posted on the developer’s website were quickly removed, as reported by AppleInsider and confirmed by me. Until yesterday, the misleading “4.9 out of 5 stars” claim remained in the App Store. However, the developer released an update only hours ago with new screenshots that no longer include the misleading claim, thereby erasing all evidence of the previous fraud. Apple approved the developer’s update and, needless to say, did not remove the app from the App Store.

[…]

There are 59 reviews [of Authenticator ℠], 54 of which are 1 star, and 3 of which are 2 stars. Two of the reviews are 5 stars; of those, one is titled “space jam” and goes on to say, “i believe i can fly and touch the sky.” Anyway, the question is, how did the app manage ratings of 4.1 out of 5 when the reviews average 1.2 out of 5? (That’s a rhetorical question. I think we all know the answer.)

28 Comments RSS · Twitter · Mastodon


> I don’t want to create another situation like App Store Search Ads where providing poor service makes the revenue numbers go up.

You don't have to create another situation where Apple provides poor developer services, because that's the reality already!

In my fantasy, the higher tier of the developer program would provide more personal service. For example, the developer would have a known agent within Apple whom they could contact with issues. And I mentioned bug reporting: a more directly line to Apple engineering, bypassing the DevBugs wall.

Currently, Apple developer customer service is atrocious, especially the first line of "support".


@Jeff Search was already bad, too, but now improving search is at odds with ad revenue, which is worse. Maybe the numbers work for a higher tier offering that’s actually good, but I doubt it. I don’t want to create a situation where everyone has to pay more just to avoid a slightly worse experience.


@Michael Search ads are worth $billions. The developer program fee is not. According to Phil Schiller's testimony in the Epic trial, there were a million developers in the paid program, so that's only $100 million per year for Apple. And only a subset of those million would pay $thousands per year for a higher tier, so it's not really moving the needle much. The point is really just to pay for Apple employees to perform services, because Apple is clearly cheaping out on that at $99.


It has long infuriated me that it is *so damned easy* to find 10 or 12 scams if you spend like any time at all looking (heck from Top Grossing alone on any given week). Apple should be able to do at least that but a LOT more; and they seemingly do nothing at all.

Meanwhile, I have certainly been raked across the coals by App Review in the past over (literally always) stupid, pathetic little things that are at best subjective and sometimes just wrong. My list of issues with App Review is 50 feet long but “look at Top Grossing for scams” would take the bare minimum effort from Apple and solve a significant part of the problem.


App Review must be infiltrated with people who either are scammers themselves (helping their fellow scammers) or come from a scamming culture (and hence don't recognize the scam apps as a problem).


Beatrix Willius

@Hammer: my guess is that the reviewers are lowly paid workers in India or similar and have a rejection quota.

Apple doesn't have any incentive to improve the app review process. A higher paid tier would solve nothing. I still think that a manual review should be abolished because it does absolutely nothing.


@hammer They want the scam apps for the money. Some are so obvious there must be people on the inside getting kickbacks. Some may be a bit clever if they use something like Google Remote Config and change the behavior of the app after it already passes review.

I don’t want to pay Apple anymore money they should just review the apps.

> Search was already bad, too, but now improving search is at odds with ad revenue

Apple Search ads and Google ads are indispensable tools for scammers. They pay for installs to drive up their app ranking. Then the scamming begins. It is a bit of a gamble because ads can be expensive but when it works it makes it all worth it.


@Hammer I think you're on to something there. That would explain why so, so many scam apps fly through review and have absolutely no problems.

The more I think about it, it absolutely is consistent with corruption and bribery. The average person has to play by the rules and is constantly being disadvantaged by those who are unfairly taking advantage. With the scale and obviousness of all these scams, it's starting to sound like the most plausible explanation.

Of course that wouldn't work if anyone at Apple cared at all about the App Store aside from the one and only metric of how many billions in profit it will make next quarter.


Reviewing millions of apps per year is hard, and already impossible to do with 100% perfection
Reviewing millions of apps *per month* is even harder and even more impossible

We shouldn’t be surprised that lots of systems that used to work (to varying degrees of ‘works’) get overloaded by the sudden flood of vibe-coded apps that AI enables. That applies to everything — government, job applications, education, engineering, science, etc.

It’s going to take a long while before we figure out systems to deal with this new normal. (Actual costs for AI, perhaps)

Also, what you and I might call a scam, other people might actually enjoy (or use differently than you or I)

Anyway, with all the legal/lawsuit pressure to change Apple’s fee structure to free distribution, perhaps Apple should just charge fees based on straight-up revenue, with a 30 to 60-day escrow before developers get paid for new apps so that scams can be disincentivized if/when users complain.

There are probably solutions but probably none that people (developers, users, Apple) will cheer for.


@Someone This was all happening before the vibe-coded apps. Apps with fake reviews or that aren’t what they claim to be are scams, not some sort of benefit in disguise.


@Michael, all I'm saying is that it's going to get even worse. Right now, $99/year is a very low barrier to entry into the app store. If we want friction, then some structural change is probably better than throwing more humans at it (especially if they're already overwhelmed/outsmarted)


@Someone Yes, I agree that they need a structural change, not just more humans or a higher financial barrier.


I disagree that a financial barrier will stop scams. Unfortunately these scammers generate Apple more money than most honest devs. From Apple’s perspective if some app is making a million dollars a year (or a month) they don’t view frequent app updates / submissions as consuming resources. They’re happy to do it…until someone like JJ blogs about it and they get shamed into taking it down.

To get the ball rolling on a scam you need to do keyword research and pick a good app name, pay for ads and ASO tools, etc. A lot of these scammers are millionaires. They’ll pay whatever…a financial barrier will just keep new people down. Rich people I think have enough advantages let’s not add more.


Are there any well known third party so stores for the Mac?

I wonder if opening up for others would lead to curated stores in niche areas. Like music production, productivity, or Finance etc.

In that way the work would be off loaded on third parties, and Apple could continue doing whatever it is they think is good enough.


"Reviewing millions of apps *per month* is (...) impossible"

Right. It's clear the only feasible solution is to stop being the sole custodian of the ecosystem through which every app must go.


> Right now, $99/year is a very low barrier to entry into the app store.

It's already $99 too much if you just need the ability to notarize your Mac applications to distribute them outside of the app store. Once you get a certificate, you should be able to notarize for as long as the certificate is valid. Then when the certificate expires, you need to renew. Otherwise, it's just a scam.


@ObjC4Life "A lot of these scammers are millionaires."

Citation needed.

TabControl Extension is definitely NOT "making a million dollars a year (or a month)" or even as much money as I am.

It doesn't appear that Alfredo Grassau is making a lot of money either.


I agree with most of these complaints, but I have a hard time with "number of apps". The "app" is an artificial abstraction (and one I don't even much like, but that's an argument for another day). There's no objective definition for what amount of functionality goes into "an app".

Microsoft grew up in the era of shrinkwrap software, so their "apps" are as big as possible. Modern lifestyle startups tend to make them as small as possible, for obvious reasons. There are tradeoffs at both extremes. Obviously any review shouldn't require the same amount of time for tiny apps and mega apps.

I'd rather have a limit on total number of subviews, or total number of bytes, per developer per quarter. That would still be problematic, but slightly less so than number of apps.

Limiting the number of apps would be like limiting the number of dialog boxes. OK, we'll just force the developer to put the same amount of crap into fewer, bigger ones. Would that help anyone?


https://www.forbes.com/sites/gordonkelly/2021/05/15/apple-iphone-ipad-warning-app-store-security-new-fleeceware-scams/

> Notably, Eleftheriou shared one screenshot (below) targeting a single developer, Dragon Game Studio, which has over 40 scam apps currently live on the App Store with combined revenues of over $3.5M.

Also you did a nice job spotting this one https://lapcatsoftware.com/articles/2026/4/2.html


I also hate the trend of using the "screenshot" area for images which are not actually screenshots. Anything other than a literal full-sized screenshot makes me suspect the app is a scam. Why else would you try to hide or disguise what it looks like?

If I were in charge of the App Store, putting cute marketing graphics there would be a bannable offense. It's a type error, like putting ads in search results. It makes people less trusting of the store's data altogether.

I might even say: developers are not allowed to provide screenshots. They can provide a script (your app *is* scriptable, right?), and we'll run it in a sandbox on our computers to generate the screenshots automatically.


@ObjC4Life That's not a lot. That's two.

A few things to keep in mind: (1) App Store revenue is very skewed toward a relatively small number of apps. Whether legit or scam, it's extremely difficult to become successful in the App Store. (2) The Mac App Store is a drop in the bucket compared to the iOS App Store. Don't expect many paths to millionaire on the Mac. The Mac App Store has so little traffic that Apple hasn't even bothered to implement search ads there. (3) Most of the revenue in the App Store goes to "free" apps with IAP. The paid app category is very poor in comparison.

Thus, 40 paid Safari extensions in the Mac App Store, for example, could be practically nothing. I know there are a ton of low effort, low volume scams in the App Store, because I've seen them. A lot of the developers appear to be from relatively poor countries, so maybe a little income goes a long way.

Be careful not to fall for survivorship bias. The most successful scammers tend to get the most media attention.


> “Right. It's clear the only feasible solution is to stop being the sole custodian of the ecosystem through which every app must go.”

Evidence? Does that work anywhere else in the world? I can point to the opposite where a single curated store can maintain quality (Nintendo eStore). How about you?

You’re proposing opening it up like the US’s market economy — so even less regulation. And you know, you’re right! The US market is totally free of scams. That really works!

Oh wait, no it doesn’t: small-time scams, big-time scams, wage theft, SpaceX, AI bubble, crypto bubble, crisis after crisis, healthcare scams, psychic scams, gambling scams, data-ransom scams, crypto-mining/stealing scams… our president.

So, some evidence would be nice to see once and a while.


> Does that work anywhere else in the world?

Literally everywhere.


> I can point to the opposite where a single curated store can maintain quality (Nintendo eStore). How about you?

The difference is that the Nintendo store, or the official Panic run PlayDate store are curated. They care (mostly) about what goes in them. The playdate is even better because there is 100% official support for installing whatever you wish on it.

So if Apple could either:
1: Start curating their stores
2: Open up for other stores

I wouldn't have any complaints. But as it is they aren't doing either.


I was going to reply to the effect that it's not Apple's job to decide what's lawful and what's not (as opposed merely to what their own stores host, of course), but Plume's post is much pithier. It would be truly magnificent if more Americans appreciated that government is not, by its very nature, inherently evil or self-serving.


> Literally everywhere.

Oh really? Then it should be easy for you to show us some evidence, yeah? Please do it.


I'm sorry, but your claim that the "US market economy" "does not work anywhere in the world" is so weird that I'm not exactly sure what you're even claiming.

But sure. Go to any store. Buy bread. There you go. You didn't pay 30% to Apple for your loaf of bread, and it's a nice loaf of bread, and if you don't like it, you can go to another store. There you go.

Also, pick up an Android phone. Android has popular third-party app stores (e. g. Epic Games Store for Android) that have literally *never* had any type of malware because they're properly curated.

Honestly, I'm genuinely confused by what you're saying.


@jeff

> In my fantasy, the higher tier of the developer program would provide more personal service

This is the same logic that leads to TSA pre-check and express lanes on freeways. Instead of fixing the underlying infrastructure, rich people get pay to bypass the problems while nothing gets resolved for everyone else.

Leave a Comment