The malware, called "Hummer," is a family of Trojans that imitate Android apps before striking, according to Cheetah Mobile, a maker of security and utility apps.
The company’s researchers have been tracking Hummer since 2014. It's been infecting more than 1 million devices per day, far outpacing other kinds of mobile Trojans, the company said in a post on Wednesday.
India, Indonesia, Turkey, China and Mexico are the top five countries where the Trojan has been spreading the most, but it's also hit victims in the U.S. and Europe.
Users are downloading Hummer Trojans thinking they’ll gain access to YouTube or other Google services. But in reality, Hummer secretly “roots” the user’s device, gaining admin-level access to the operating system.
It then installs any number of unwanted apps, including games and apps related to porn. In addition, the Trojan serves countless pop-up ads to the screen. In Cheetah Mobile’s own testing, Hummer could force the device to download 2GB worth of network data within hours.
Even users who try to uninstall the apps will find them reinstalled again, the company added.
The developers of Hummer are probably making money by serving ads and forcing the app installations. That could be enough to generate about US$500,000 a day, Cheetah estimated.
China might be the source of the Trojan family. The group behind the malware has been using domain names that are linked to an email account in that country.
Hummer is difficult to delete, and even a factory reset won’t eliminate it, Cheetah Mobile said. Cheetah says it has an app that can remove the malware.
Users have a better chance of avoiding Android Trojans if they don't download apps from untrusted sources. This is more difficult in some places, such as China, where there is no access to Google Play. Users there download apps from third-party app stores, exposing them to possible malware.
Kaspersky Lab has also said it has detected Hummer, but it calls the malware "Trojan.AndroidOS.Iop."