Ask HN: Why are we receiving thousands of fake users?

We are a small company (<20 employees) who publish an popular app (within its niche) used by millions of people. The majority of our real users reside in North/Central America and Western Europe. Recently we began to see hundreds of thousands of installs showing up on Google Analytics from unexpected countries. The installs did not show up on the Play Console analytics, implying these users obtained the .apk from some other source. The bulk of these users are from Pakistan, India, Egypt, and Iraq, but these installs are also occurring in dozens of other developing countries. The event data we get from Google Analytics implies that most of the users quickly uninstall the app after installing it. About 5-10% of them create an account and verify their email address. We've gotten a handful of support emails and a couple of Play Store reviews wherein the user claims our app was installed without their intent or knowledge. We are concerned that whoever is behind this has a malicious objective, but haven't come up with a plausible explanation, and thus are hoping someone else has experienced similar phenomenon and would recognize this pattern.

Could be a click farm by an ad agency trying to meet a campaign target. Do you have ads within your application?

No. The app can be used without signing up at all. After you sign up, you are required to verify your email address (via email, not SMS) to receive a free trial which we offer.

One theory we came up with is that our competition could be trying to get our app marked as spam or malware, and thus booted from the Play Store. If they have some sort of exploit that allows them to install arbitrary .apks on hundreds of thousands of Android devices, which seems probable if this is a malicious attack, it's unclear to me what we could do to prevent them from spamming our .apk to these users.

Just block users from third world countries. They are too often more trouble than they are worth.