Security researchers have issued warning for Ai.type, an Android third-party keyboard app, that’s been found stealthily signing up users for millions of unauthorized purchases of premium digital content.
The findings — disclosed by mobile tech company Upstream — reveal the app was downloaded over 40 million times.
Troublingly, it’s active on million of devices to this date, despite being removed from the Google Play Store in June.
In addition, Ai.type delivers invisible ads and generates phony clicks, while requiring extensive permissions to use the app — including access to text messages, photos, videos, contacts, and on-device storage.
“Ai.type carries out some of its activity hiding under other identities, including disguising itself to spoof popular apps such as Soundcloud.
The app‘s tricks have also included a spike in suspicious activity once removed from the Google Play store,” the researchers said.