First there was the Infrared X-Ray Android app targeting users from Japan. However, upon further review, Android.Uracto, the malware hidden in the application, is in additional apps.
At least 10 new apps have the malware, advertised as video game emulators, adult video viewers, fortune teller apps, and celebrity gossip apps, said researchers at Symantec.
Security researchers said the malicious applications fall into three categories: Ones that simply steal contact data from the infected device, ones that steal the contacts and send them SMSs to advertise the applications, and ones that steal contacts and try to convince users to pay for fake services.
It is still a bit uncertain as to how users end up lured to the sites hosting these apps, but researchers believe the cybercriminals might be using spam messages.
It turns out Uracto shares common code with Android.Enesoluty and Android.Maistealer, both pieces of malware designed to target Japanese users.
Experts said either the same group created the malicious apps, or different organizations hired the same malware developer.