New Malicious Clicker found in apps installed by 20M+ users

McAfee Mobile Research identified a Clicker Android malware campaign that slipped into Google Play via 16 utility apps (estimated ~20 million installs). The malware uses remote configuration and Firebase Cloud Messaging to trigger background browsing and automated clicks (libraries com.click.cas and com.liveposting), causing ad fraud, heavy network/power usage, and stealthy operation; the report includes IoCs (domains and SHA256 hashes) and recommends removal and use of mobile security.