Google has removed about 300 more apps from the Play Store service, after several cyber security researchers from various companies found this app to be disguised as a harmless product.
In Google's official description, these apps, which offer video player functionality, ringtones, and other functions, secretly hack Android devices to be one of the paths of launching DDoS.
Botnet named WireX is found security researchers in Akamai network, when trying to attack one of his clients, earlier this month. This Akamai customer suffers attacks from hundreds of IP addresses.
"We have found about 300 applications related to this issue, and have made blocking," Google said in a statement quoted from Gizmodo. "We are in the process of removing it from all infected devices."
As already explained, the app suspected of causing the DDoS offers a service that looks official, and has built in a malware that clandestinely causes DDoS attacks, as long as the device is on.
To disguise it, this app provides information that can persuade users of the device ANdorid, that this is a secure application, such as providing various features listed in the description on the Google Play Store.
This app is also bundled with other smaller apps, which will be active once installed on the phone. Then, the malware will wait for the command from the central server to attack. In the context of an attack on one of Akamai, this malware moves simultaneously from about 130 thousand IPs.
There is no certainty yet about the number of infected devices, but cyber security reporter Brian Krebs gets information from insiders Akamai, there are about 70 thousand devices that are infected with this malware.
Akamai is also one of the network providers, taking immediate action by asking for help from various security companies, such as Cloudflare, Flashpoint, Google, Oracle Dyn, RiskIQ, and Team Cymru. The team believes this infection has spread in 100 countries.