Its named Autolycos from the homonymousGreek mythological figure, known for his mastery in thievery and deceit.
And thats exactly what the malware does.
Since June 2021, Ingrao has identified eight infected apps on Play Store downloaded over three million times.

8 applications since June 2021, 2 apps always in Play Store, +3M installs ?
40% off TNW Conference!
Thats why its been undetected for so long.

Ingrao identified 74 ad campaigns for one of the infected apps: the Razer Keyboard & Theme app.
To promote the applications, fraudsters create several Facebook pages and run ads on Facebook and Instagram.
Which are the infected apps?

On July 13, Google removed the last two: Funny Camera and Razer Keyboard & Theme.
It shares the exact same picture and description, only now its calledVlog Star Video Maker.
With a background in the humanities, she has a soft spot for social impact-enabling technologies.
