The “Goldoson” Android malware has breached into Google Play. It has been found in 60 legitimate apps with 100 million downloads each.

The noxious malware part is coordinated into an outsider library that the engineers incidentally integrated into each of the sixty applications, reports BleepingComputer.

Malware affecting Google Play apps

The Android malware, found by McAfee’s examination group, is equipped for gathering a scope of delicate information, remembering data for the client’s introduced applications, WiFi and Bluetooth-associated gadgets, and GPS areas.

Also, it can perform promotion extortion by clicking advertisements behind the scenes without the client’s assent, as per the report.

The library registers the device and obtains its configuration from an obfuscated remote server when a user runs an app that contains Goldoson. The setup tells Goldoson how often and what data-stealing and ad-clicking tasks it should perform on the infected device.

In addition, the report stated that the data collection mechanism typically activates every two days and sends the C2 server a list of installed apps, a history of the device’s geographical location, the MAC addresses of Bluetooth and WiFi-connected devices, and other data.

How much information not entirely settled by the consents conceded to the tainted application during establishment as well as the Android rendition.

The loading HTML code, introducing it into a tailored, hidden WebView, and then employing that to execute a number of URL visits generates ad revenue. Despite the fact that Android 11 and later are better protected against arbitrary data collection, researchers discovered that Goldoson had enough access to sensitive data in 10% of the apps, even in newer OS versions.