Update: Shortly after publishing, the app has been pulled from the store. Original story below.
A free-to-play app called Zoshy+ has been gradually climbing up the Puzzle game charts on the App Store. Based on its screenshots and app description, the app looks like an innocuous Sudoku client.
Zoshy+ is listed under the developer account with the name “Ha Miller,” the individual’s only published app.
This app appears to have circumvented App Review by taking advantage of server-side controls. When the Zoshy+ app is installed and launched for the first time, the basic shell of the Sudoku’s game’s UI is presented. This initial state matches what is shown in the app’s screenshots.
After a few seconds, all of the content in the app is replaced with the illicit video browser interface, including tabs for exploring TV shows and movies. It seems likely that when the app was submitted for review, only the embedded Sudoku features were activated for the App Review team to test. The developer later enabled the alternate behavior via a server-side change.
Apple has said that it employs strategies to help catch nefarious developers that attempt stunts like this, but evidently they are not foolproof. In the Apple vs. Epic trial documents, executives referred to this class of abuse as “Jekyll apps.” Last August, Epic kicked off its legal challenges against Apple by secretly adding a backdoor switch into Fortnite that enabled a direct payments mode for players to buy V-Bucks, subverting Apple’s In-App Purchase rules.
The functionality of the application is surprisingly sophisticated and rich with top charts, trending and featured content carousels to explore. Apart from the incessant ads, it could almost pass off as a legitimate Netflix competitor — aside from the obvious fact that all content in the app is being shared illegally without permission.
The Zoshy+ app has been listed in the App Store for about three weeks, and is ranked about 50th on the Apple Store Puzzle Games downloads charts. User reviews dated as far back as June 4 discuss the pirate functionality openly: “It’s really good because I can watch shows that aren’t on Netflix.” One user review says they discovered the app based on a TikTok video, which has accrued more than 2.6 million views.
Zoshy+ is obviously trying to make its money by generating ad revenue. The application tells users that the banner ads and interstitials can be removed by sharing a very sketchy-looking link with their friends. That being said, user reviews indicate that it doesn’t matter how many times they share the app, the ads remain.
Epic Games, Spotify and others have questioned whether Apple’s monopolistic control over app market on iOS is really about user experience and customer safety, or whether it’s about making money. Instances like this one don’t help Apple’s argument. Of course, Apple says the App Store offers industry-leading customer protection and cases of apps slipping by its App Review controls represent a very small minority of the tens of thousands of apps examined by Apple’s automated processes and teams of human reviewers each month.
