SpyLoan Android malware on Google play installed 8 million times

A set of 15 malicious "SpyLoan" Android apps were discovered on Google Play with over 8 million installs; they posed as loan services, collected OTPs and sensitive documents, and abused device permissions to exfiltrate SMS, contacts, call logs, camera, location, and banking information to enable extortion and harassment of victims across South America, Southeast Asia, and Africa. McAfee identified and reported the apps, which have since been removed, but their repeated appearance on the Play Store highlights ongoing risk and targeting of vulnerable users.