Google Authenticator’s look. A different developer’s password vault.

The screenshots tell the story.

All five original current Mac promotional images are preserved. The fifth advertises cloud backup but visibly describes launching when Windows starts. These are the seller’s public claims and images, not results of installing or testing the software.

See all 4 additional screenshots

A Google Authenticator look-alike is being used to market a separate security app whose linked policies do not clearly explain protection of login secrets and cloud backups.

The name on the listing.

App name

Authenticator:2FA Login Codes

Developer / seller

Mubashir Iqbal

Developer country · App ID 6807766127

Pakistan · Connected studio operating-country attribution. The Mac app links the same company privacy URL and support domain used by the Pakistan-declared Google Play company. This is not an Apple trader-country declaration or independent verification of the individual seller’s residence. The website’s Wyoming LLC identity is recorded separately.

Connected LowByte studio business sources, checked 3 November 2026: Google Play company panel declares Rawalpindi, Pakistan (E12); related publisher panel also declares Pakistan (E14); homepage-linked studio profile describes Islamabad operations (E22).

A Google-like security identity, without Google as seller

The investigated icon closely imitates Google Authenticator’s recognisable multicolour asterisk. Both have six rounded spokes arranged around a central crossing, with the green, yellow, blue and red palette on a white tile. The new design adds glossy bevels, a white central star and sparkles, while rotating the arrangement and changing how the colours overlap.

App Scam DB assesses the overall presentation as a look-alike branding warning. The app is called Authenticator:2FA Login Codes, not Google Authenticator, and its subtitle is Two Factor Authentication, OTP. Authenticator is a descriptive product term; the specific concern is the recognisable visual borrowing in the same security category. Service icons such as Gmail or Facebook inside account cards can identify supported accounts and do not by themselves prove impersonation.

Google’s guidance prohibits imitation of its visual identity, including distinctive colour combinations and product icons, and forbids implying an affiliation that does not exist. The observed artwork raises an apparent brand-use concern under that guidance. No Google permission, affiliation, enforcement decision or legal infringement judgment was established.

The official comparison is Google LLC’s iPhone/iPad app, ID 388497605. The investigated Mac product is sold by Mubashir Iqbal, ID 6807766127, with separate purchases. The icon comparison identifies whose brand is being evoked; it does not imply Google sells this Mac product or that different-platform feature sets are equivalent.

A password vault deserves more than generic game policies

The App Store privacy button and the privacy URL inside the description lead to different documents. The first is a dedicated-domain policy naming LOWBYTE STUDIO (SMC-PRIVATE) LIMITED. The second is a long Google Sites document discussing games, children, visual communication and status content. They are both reachable, so the finding concerns their content rather than broken links.

The Google Sites text asserts in one passage that no information is transmitted or stored online, but elsewhere describes personal information, advertising identifiers, analytics, marketing and retention. The Mac listing declares identity-linked purchases, contact information, user content, identifiers, usage data and diagnostics. The policy’s sweeping no-collection/no-online-storage statements do not coherently explain those declarations or the advertised cloud backup.

Neither checked privacy document clearly explains storage of TOTP secrets and vault passwords, backup recipients, encryption/key custody, restore authorization or deletion of cloud copies. The dedicated-domain policy lists generic third-party services and broad data retention, but does not identify which apply to this Mac authenticator. A generic SDK list does not prove those SDKs run in the app.

This is a disclosure failure, not proof that passwords have leaked or that the Mac executable sends secrets to an attacker. An authentication app handles credentials capable of unlocking other accounts; the missing explanation is therefore central to assessing the product’s security promises.

The Mac advertisement says Windows; Android shows a different product

The full Mac cloud-backup advertisement and its enlarged native-pixel detail below show a startup setting referring to Windows. This is the current Mac App Store promotion for a product requiring macOS 15.6. The mismatch is visible in the listing’s own image; it does not establish what the installed executable actually does.

All seven original Android store screenshots were separately retrieved and inspected. They show a mobile dashboard, setup guidance and utility settings, without the Windows startup sentence. The Windows wording is therefore attributed only to the Mac promotion. The Android captures are reproduced in the next section so the two products can be compared directly.

The linked terms are also written around games: they discuss gaming behavior and describe a game developer as RG in the app-store section. They set a minimum user age of 16, while Apple rates the app 4+. The documents’ different scopes and audience conditions are unresolved, rather than evidence of an observed child-data incident.

The Google Sites policy and terms print the malformed date 08-May-20245. The terms invoke Estonian intellectual-property laws and California law/courts in different passages. Neither phrase establishes a developer’s actual country. Together with the gaming content, these details show why a dedicated security-product explanation is needed.

All seven original Android store screenshots

These are the seven unique original Google Play screenshots for LowByte’s related Android authenticator. They are distinct from the five Mac promotional images preserved above. Captions identify the platform and visible feature, without treating simulated verification codes as real account credentials.

The fifth Android image advertises storing codes in a Google Account, while the seventh offers Google import and other utility controls. These are marketing claims; this investigation did not test a Google integration, cloud encryption or account recovery.

The LowByte links are stronger than a matching surname

The Mac listing’s support domain and privacy button directly connect it to LowByte’s infrastructure. The dedicated-domain policy names LOWBYTE STUDIO (SMC-PRIVATE) LIMITED. The Android authenticator under that exact company name links the identical privacy URL and support domain. This is a direct shared legal/support infrastructure connection across stores.

A separate Google Play display publisher, LowByte Studio, discloses Rabia Aslam as its business identity on Category Sort: Puzzle Game. That app links the same custom-domain Google Sites privacy document named in the Mac description. The studio website additionally features Arrows & Screw using the exact package ID from this second publisher’s catalog. The shared document plus first-party portfolio link support an operational studio association.

The studio website’s public client bundle links Apple developer BAYBEEBRAIN, ID 1822542033, and a Real Strike game. The Apple developer page resolves, but the current US software lookup returns no apps for it. This establishes a website-published account link, not common legal ownership, an active portfolio or a ban-evasion history.

The network can be traced through explicit links, names and document URLs. Those records do not establish which individual controls every account, whether the people are related, or whether another app in the network is fraudulent. No prior Apple termination or deliberate account-circumvention sequence was verified.

What the connected accounts currently publish

Apple’s current US catalog and software lookup return three apps under Mubashir Iqbal. Their numerical IDs and release dates are recorded below. The oldest app release is not the account-creation date. None of the other two Apple products is labelled fraudulent by association.

The company Google Play catalog displays five apps. The separate LowByte Studio game catalog displays nine games. These are current observed catalogs, not all-time release counts. The tables list titles and stable identifiers so readers can distinguish the accounts instead of treating the shared studio branding as one numerical account.

The second Google Play catalog

This account displays LowByte Studio while its developer details identify Rabia Aslam. The exact Arrows & Screw package is linked from the studio’s own homepage portfolio. These games are included to document the account connection, without making an infringement or fraud finding about their titles or artwork.

A related Android authenticator already attracts Google confusion

The related Android authenticator uses almost the same glossy four-colour spoke design, with a central star. Its publisher is the LowByte company, not Google. The current Android listing displays 100K+ downloads; this figure does not describe the Mac app. Its original icon is now shown in the four-store comparison at the top of the report.

A native review by Leo, dated 3 October 2026, complains about advertising and calls it a “gogal app”. That wording suggests the reviewer perceived it as a Google app. It is a consumer’s account on the related Android product, not a Mac buyer complaint or proof of a verified payment scam.

Google Play also displays a declaration that the Android app’s data is not encrypted. That is a developer-provided Android disclosure, not an independent security audit and not proof that the Mac app stores or transmits secrets unencrypted. The discrepancy deserves attention alongside the security marketing, while each product’s evidence remains separate.

Pakistan: the connected studio’s documented operating country

The connected company’s Google Play business panel declares Rawalpindi, Pakistan. The second Google Play publisher’s developer details identify Rabia Aslam in Pakistan. The studio’s own linked LinkedIn company profile describes Islamabad operations and Pakistan recruiting. These are direct business-source location statements, not an inference from the developers’ names.

The current studio website footer instead identifies Lowbyte Studio LLC in Sheridan, Wyoming, United States. A US entity and Pakistan operations can coexist. No incorporation record or ownership document was obtained to establish how the LLC, Pakistani company and individual Apple seller are legally related.

The report attributes Pakistan as the connected studio’s operating country, supported by the matching Mac/Android policy and support infrastructure plus the studio’s Pakistan business disclosures. Apple Germany and Ireland still list Mubashir Iqbal as a non-trader without a country. The attribution is therefore labelled as a studio association, not as an Apple trader declaration or proof of the individual’s residence. The Wyoming LLC website identity is recorded separately.

The lifetime label does not define the cloud promise

The lifetime offer is explicitly $99.99 in the US and €99.99 in Germany and Ireland. Two other premium prices are shown without billing intervals in the public table. The description gives auto-renewal/cancellation language but does not map those periods to the two generic purchase labels.

The linked game-oriented terms allow services to be discontinued and disclaim compensation in that context, but do not clearly define what lifetime means for this authenticator’s cloud backup. The investigation did not obtain an in-app purchase screen or test a purchase. It therefore does not claim a hidden weekly charge, a completed payment or an observed loss of access.

The app also markets extended verification-code timers up to five hours, qualified by where supported. TOTP requires the generator and verifying service to share the time-step parameter; changing a local countdown cannot extend a website’s acceptance window by itself. The listing does not explain compatible services or provisioning. No authentication-code test was performed.

The dates support a current warning, not a ban-evasion story

Apple records the first release of this Mac app and version 1.0 on 28 September 2026. The source capture is dated 3 November, 14:29:09 UTC. The exact source URL has a Wayback capture thirteen seconds later, and its replay opened. No earlier usable Apple icon or title sequence was established.

The indexed iOS authenticator 6792724838 and a Rabia Aslam Apple product 6768563654 contain LowByte-related leads in search results. Their fresh US pages returned 404 and current lookups returned no records. BAYBEEBRAIN’s developer record still resolves but returned no current US software. These observations do not establish an Apple ban, its reason, who controls an absent app or deliberate review evasion.

Apple rules 2.3, 4.1 and 5.2.1 are relevant to accurate platform imagery and look-alike identity; privacy rule 5.1.1 is relevant to the app-specific explanation of sensitive data; subscription rule 3.1.2 is relevant to clear paid terms. The findings support review of those concrete issues. No additional proven fraud case, private account record or Apple enforcement notice was obtained.

The records behind this report.

The entire supplied 12-page PDF is appended, including its original Mac store, promotion and policy captures. Source hash independently calculated. The written investigation adds current original Google Authenticator artwork, current LowByte infrastructure and publisher catalogs, a native related-Android review card and full linked policy text. No executable installed, purchase made, authentication secret imported or runtime data flow tested. Native screenshots are identified; cropping excludes irrelevant page furniture and business-contact details without changing the evidence shown. The updated report adds all seven original Android store screenshots, both store-specific official Google icon references and a clearly labelled native-pixel crop of the Windows text in the Mac advertisement.