Nasty adware hiding in apps on Google Play Store

Zscaler ThreatLabZ discovered and analyzed 12+ malicious Android apps on Google Play that act as aggressive adware: they contact a C&C which can instruct them to request device-administrator privileges, download and execute a secondary dex (secondlib.dex), hide the app icon, and perform ad-related actions (fullscreen ads, open links, launch videos/apps, create shortcuts). The report details code injection into a spoofed com.google.android.gms package, obfuscated strings, runtime dex loading, observed download counts (10k–50k for some apps), a full list of malicious package names, and notes the apps were reported and removed in March 2017.