https://arstechnica.com/information-technology/2017/10/google-play-apps-with-as-many-as-2-6m-downloads-added-devices-to-botnet/

Google has booted eight Android apps from its Play marketplace, even though the apps have been downloaded as many as 2.6 million times. The industry giant took action after researchers found that the apps add devices to a botnet and can perform denial-of-service attacks or other malicious actions.

The stated purpose of the apps is to provide a skin that can modify the look of characters in the popular Minecraft: Pocket Edition game. Under the hood, the apps contain highly camouflaged malware known as Android.Sockbot, which connects infected devices to developer-controlled servers. This is according to a blog post published Wednesday by researchers from Symantec. The malware mostly targets users in the US, but it also has a presence in Russia, Ukraine, Brazil, and Germany.