11 million devices downloaded malware from Google Play. You;

Five years ago, researchers discovered a legitimate Android app on Google Play that was secretly made malicious by a library used by developers to earn advertising revenue. The app was infected with code that caused 100 million infected devices to connect to servers controlled by the attackers and silently download additional malware.

History repeats itself.

Researchers from the same Moscow-based security firm they said on Monday that they found two new apps, which have been downloaded from Google Play 11 million times. The apps were infected by the same malware family. The researchers, from Kaspersky, believe that some software developer kit is responsible for embedding advertising features.

Researchers found the Necro malware in two Google Play apps. One was Wuta Camera, an app with 10 million downloads to date. Wuta Camera versions 6.3.2.148 to 6.3.6.148 contained the malicious SDK.

The app has since been updated to remove the malicious component.

A separate app with around 1 million downloads, also known as Max Browser was also infected. This app is no longer available on Google Play.

The researchers also found that Necro infects many other Android apps available in alternative stores. These apps usually appear as modified versions of legitimate apps like Spotify, Minecraft, WhatsApp, Stumble Guys, Car Parking Multiplayer and Melon Sandbox.

Indicators of compromise

Applications infected with the loader