Cyber security experts have discovered more than 20 apps that are secretly spying on people through their phones, according to a Sun technical report.
Disguised as legitimate apps for activities like yoga, questionable downloads record video and audio, steal contacts, photos, messages, and more.
That's because it's loaded with PhoneSpy, a program that hacks scammers, according to Zimperium researchers.
In a blog post published last week, the US security firm revealed that more than 1,000 Android users have been infected with the newly discovered malware.
It was discovered that a total of 23 PhoneSpy apps were not available in the Play Store, the official Google Play Store for billions of Android phones.
Instead, it is believed to have been passed from one device to another via spoofed links sent in emails or text messages.
All infected devices are in South Korea, although researchers have not ruled out the possibility of infection in other countries.
Zimperium researcher Aazim Yaswant wrote: “These malicious Android apps are designed to run silently in the background, constantly spying on their victims without arousing any suspicion.
We believe that the malicious actors responsible for PhoneSpy have collected large amounts of personal and commercial information about their victims, including private communications and photos.”
The PhoneSpy apps identified by the team were used as apps for learning yoga, viewing photos, watching TV, and other activities.
Once inside the device, the malware is able to access the user's camera, GPS location, text messages, phone contacts, etc.
It can also hack the passwords of Facebook, Instagram, and Google accounts.
It is believed that malware can spread by using infected devices to send malicious links to contacts saved on them.
According to Zimperium, victims may know each other personally or relate through work or other affiliations.
Without knowing who was behind the attacks, the security company notified and provided all relevant threat data to the United States and South Korea.
To avoid conflict with PhonySpy or similar malware, be careful when installing apps outside the Play Store.
Google Play Market has security controls that prevent most malware from accessing its pages.
Apps from third-party stores are not necessarily subject to the same level of scrutiny, which makes it a risky download process.