50 apps with SMS malware found in Play Store. See full app list here.

One of the biggest malware outbreaks on Android has just hit users through Google’s own Play Store.

The malware was found in at least 50 apps installed through Play which all carried a similar version of the malware. It is estimated that millions of devices were affected by the installs, according to Check Point Software.

“This was one of the most extensive malware campaigns to infiltrate Google Play Store, both in size and in its malicious effect,” Daniel Padon, an employee at Check Point.

Unlike most malware, which generates money from pop-up ads, this recent outbreak directly hit users in the pocket by auto-subscribing users to expensive SMS services. Each time a message was recieved from these services a fee was deducted from the user’s balance or charged to their monthly bill.

Malware experts named the malware “ExpensiveWall”, dubbed such due to one of the of the infected apps, “Lovely Wallpaper.” Other notable infected apps included “I Love Filter,” “Tool Box Pro,” and “Horoscope.”

The malware evaded Google’s security filters by using an advanced form of “packing,” which is a method that compresses and encrypts infected code.

Check Point notified Google, after which Google removed the offending apps from the Play Store. Immediately following this another version of the malware popped up and infected 5000 devices before Google took reign again.

[spoiler title=”List of known apps with the SMS malware”]

There were some red flags for the malware as users left reviews which reported the issue. However, it is notoriously difficult for Google to detect this form of reporting because of “app review wars,” where competing authors will pay review services to leave bad reviews on a competitor’s app.