Apple's App Review process is facing intense scrutiny as blatant Mac App Store scams slip through the cracks, leaving legitimate developers stranded in lengthy approval queues. The controversy ignited after researchers discovered the TabControl Extension, a fraudulent Safari add-on that climbed to the top of the top paid Safari extensions in the Mac App Store using AI-generated screenshots and fake reviews.
The TabControl scam highlights severe vulnerabilities in Apple's automated and manual screening processes. According to developer Jeff Johnson, the app uses an AI-generated image masquerading as a Safari interface, complete with incorrect toolbar elements. Furthermore, the developer manipulated the App Store rating system by embedding a fake "4.9 out of 5" graphic directly into the screenshot. The actual written reviews, all suspiciously five stars and written in English outside the US storefront, carry dates that predate the extension's official release.
While scams bypass the gates, legitimate creators are facing unprecedented delays. Developer Marco Arment recently waited 12 days for Apple to approve his new app, Unforgetful. This bottleneck appears to be exacerbated by spam submissions. Johnson noted that the developer behind the TabControl scam manages 41 apps and submitted at least 368 updates - mostly generic "Bug fixes" - within a single year. Johnson warned that Apple seems "asleep at the wheel," questioning why the company does not rate-limit submissions.
How to Spot Fake Safari Extensions
With malicious extensions slipping past Apple's defenses, users must take proactive steps to verify the software they install. Here are the most effective ways to identify a fraudulent app before downloading it:
- Check the review dates: If user reviews predate the app's official launch date on the store, they are fabricated.
- Scrutinize the screenshots: Look for AI-generated artifacts, such as warped UI elements, incorrect macOS window buttons, or fake rating graphics baked into the image.
- Verify the developer website: Scammers often link to barren pages or suspicious URLs instead of legitimate support sites, such as the redirect used by the TabControl developer:
https://aee5e5015.app-ads-txt.comThe debate over how to fix the queue has divided the developer community. Johnson advocates for lowering the gates for proven, trustworthy developers, arguing that treating everyone like a potential scammer wastes Apple's resources. Conversely, John Voorhees argues that erecting barriers or creating paid fast-tracks would "starve Apple platforms of fresh, innovative ideas" from students and indie creators.
You shouldn’t have to be the one to investigate apps you want to try. That is the future of third-party App Stores, and that is a future to be fought. But that future is here with the first-party App Store we already have.
- William Gallagher, AppleInsider
How Trust Scores Can Stop Mac App Store Scams
The current egalitarian approach to the Apple App Review process is fundamentally broken. By giving a known spammer submitting 368 generic updates the same priority as a veteran developer, Apple is inadvertently weaponizing its own review queue against the ecosystem. The solution isn't a "pay-to-play" fast track, which would only empower well-funded scammers who view higher fees as a simple cost of doing business.
Instead, Apple must implement a reputation-based trust system, similar to how community platforms like Discourse gradually increase user privileges over time. Accounts with a long history of adhering to guidelines and maintaining a reasonable update cadence should earn faster approvals. Meanwhile, new accounts or those exhibiting erratic submission behavior - like pushing daily updates without real release notes - should be placed in a heavily scrutinized, lower-priority queue. Until these incentives change, the App Store will continue to drown in AI slop while legitimate innovation waits on hold.
