Symantec researcher Irfan Asrar says two games uploaded to Google Play in late June—”Super Mario Bros.” and “GTA 3 – moscow city”—scored 50,000 – 100,000 downloads before being discovered. Steven Musil at CNET:
The Trojan’s authors avoided detection during Google Play’s automated screening process by breaking up the malware into separate, staged payloads, Asrar said. Once downloaded and installed from Google Play, the apps would download an additional package for installation that sent the text messages.
