A family of Android spyware called Autolycos slipped past Google's review process and ended up distributed through the official Play Store, according to research shared by a French security analyst on Twitter. Eight infected apps were eventually removed after racking up roughly three million installs combined, and several were being advertised on Facebook and Instagram to drive downloads.
The campaign is a reminder that "official store" is not the same thing as "safe store," even in 2022. It also mirrors tactics used by the long-running Joker spyware family, which makes the tradecraft easier to reuse and harder to catch.
- – Apps affected: Funny Camera (500,000+), Vlog Star Video Editor (1,000,000+), Creative 3D Launcher (1,000,000+), Wow Beauty Camera (100,000+), Emoji Gif Keyboard (100,000+), Freeglow Cam (5,000+), Coco Camera v1.1 (1,000+), and Razer Keyboard & Design (50,000+).
- – Capability: SMS, contacts and device info theft, and silent registration of victims for premium WAP services.
- – Exposure window: malicious versions of these apps were live on Play since at least June 2021.
- – Discovery: surfaced publicly last week by researcher Maxime Ingrao via Twitter.
- – Promotion channel: some of the apps were pushed through paid social ads on Facebook and Instagram.
How we got here
Joker-style fraud has been a persistent nuisance on Android since at least 2017. The pattern is familiar: small, plausible utility apps (camera filters, keyboards, launchers, GIF tools) that hide subscription-billing or SMS-paid service abuse behind innocent permissions. Google has repeatedly claimed tightened Play Protect detection and manual review, yet families like Joker, Harly, and now Autolycos keep resurfacing in new guises.
The interesting shift here is the promotion layer. Reporting on the discovery, according to tripwire.com, notes that several of the Autolycos apps were actively advertised on Facebook and Instagram. Paid social gives attackers a credibility halo that organic Play Store discovery does not. A polished ad, a familiar icon, and a five-star review average buys trust that the malware itself cannot earn on its own.
What changed now
Two things make this wave worth flagging rather than filing under "another Joker variant." First, the install counts are large for a single family: 3 million across just eight known apps, with two of them clearing the million-install mark. Second, the apps were live for roughly a year before public disclosure, which puts pressure on Google's pre-publish review timeline.
For defenders, the tradecraft is the same playbook as Joker: enroll the device into premium-rate WAP or SMS billing flows, exfiltrate contact lists, and piggyback on the user's legitimate network for command-and-control. The cost shows up in two places: the user's phone bill, and the organization's mobile attack surface if any of those devices are used to access corporate mail or apps.
Who is affected
The immediate victims are end users who installed any of the eight named apps and granted the requested permissions. The second-order group is small and mid-sized businesses where employees install utilities on BYOD or lightly managed devices that also reach Outlook, Teams, Salesforce, or other authenticated SaaS. A spyware foothold that reads SMS is a particularly bad fit for any environment relying on SMS-based MFA.
Vendors with a stake here include mobile EDR shops, mobile threat defense providers, and any MDM team that can push app blocklists or remove sideloaded Play Store packages remotely.
What it means for you
Say you run IT at a 200-person company with a mix of corporate-issued and BYOD Android phones. Pull the eight package names from public lists and push them as blocked apps in Google Workspace Managed Config or your MDM of choice. Audit your MDM telemetry for any device that installed Vlog Star Video Editor, Creative 3D Launcher, Funny Camera, or Emoji Gif Keyboard, and force a factory reset on hits rather than just uninstalling, since the WAP-billing component may persist in residual state. Finally, treat any device that had the malware installed as untrusted for MFA purposes and reissue TOTP or hardware keys for affected users.
Our analysis
Google's Play Protect model leans on post-install scanning and machine-learning review of submitted APKs, and it catches the vast majority of malicious submissions. The Autolycos case, however, shows the failure mode clearly: low-and-slow apps that look clean at submission and only activate premium-billing or C2 behavior after passing review. That is the same gap Harly exploited in 2021 and that Joker variants have used for years.
The uncomfortable trade-off is between review latency and store openness. Tighter pre-publish analysis would slow app updates and frustrate legitimate developers; looser review is what makes Play attractive in the first place. Expect Google to respond by tuning detection rather than overhauling the model, which means defenders cannot rely on Play alone.
Worth watching next: whether Meta tightens ad review on developer accounts that advertise utility apps with unusually high install-to-review ratios, and whether any of the eight apps resurface under new developer identities, which is the standard Joker-family pivot.
- – Google has removed the eight known Autolycos apps at the time of writing.
- – Three million combined installs means a non-trivial slice of users still have the malware on-device and may not see a removal prompt until the next Play Protect cycle.
- – Mobile threat intel feeds (e.g., MTP-aware EDR, Zimperium, Lookout, Wandera) have already pushed indicators; check your console for matches.
Bottom line
Autolycos is a textbook Joker-style campaign that got a year of runway on the official store and a paid ad boost from Meta platforms. For security teams, the action is simple and unglamorous: block the named packages in MDM, hunt telemetry, reset compromised devices, and reissue any MFA factor that lived on those phones.
Frequently asked questions
What is Autolycos malware?
Autolycos is an Android spyware family that reads SMS, contacts, and device info, and silently signs victims up for premium-rate wireless services. It shares most of its tradecraft with the long-running Joker spyware family.
Which apps were infected with Autolycos?
According to research summarized by tripwire.com, the known apps include Funny Camera, Vlog Star Video Editor, Creative 3D Launcher, Wow Beauty Camera, Emoji Gif Keyboard, Freeglow Cam, Coco Camera v1.1, and Razer Keyboard & Design. All have since been removed from Google Play.
How did Autolycos apps reach so many users?
Several of the apps were advertised through paid campaigns on those Meta platforms, which gave them visibility and credibility beyond organic Play Store discovery. Combined installs across the eight known apps reached roughly three million.
What should a security team do right now?
Push the package names to the mobile device management blocklist, hunt MDM and EDR telemetry for installations of the named apps, force a factory reset on any hit rather than just uninstalling, and reissue MFA factors that lived on the affected devices.
Is Google Play Protect enough to stop this class of malware?
Play Protect catches most of it, but Autolycos is a reminder that low-and-slow submission-then-activate campaigns can sit on the official store for months before detection. Layering mobile threat defense or MDM policy on top of Play is the realistic answer for organizations.