Do not grant permissions to an app that it should not need: torches and star-gazing apps don’t need access to your contacts and phone. And never grant accessibility permissions that facilitate device control unless you have a need. Once a month, scan through your phone and delete a few of the apps you no longer need or haven’t used in a long time.

The malware was spotted circulating via apps called 'Wuta Camera' and 'Max Browser' on the Google Play Store, according to Kaspersky.

Presence of the malware was found on two Play Store apps, namely Benqu's Wuta Camera and the now-removed Max Browser. The former boasts over 10 million downloads, and contained the Necro Trojan from version 6.3.2.148 (July 18) through version 6.3.6.148 (August 20).

WSAGAScript is a tool that lets you easily patch the Windows Subsystem for Android to install the Google Play Store.

A new version of the Necro malware loader for Android was installed on 11 million devices through Google Play in malicious SDK supply chain attacks.

Researchers have discovered that two popular Android apps were infected with the Necro malware, compromising over 11 million devices. Learn more about how the malware operates and how to protect your device.

Enlarge / It's never explained what this collection of app icons quite represents. A disorganized app you tossed together by sideloading? A face that's frowning because it's rolling down a bar held up by app icons? It's weird, but not quite evocative.

This is critical because Google isn’t deleting apps from phones, and so if you have such low-quality, higher-risk apps on your device then the onus is on you to make an honest assessment and to delete— not just leave in place —those apps that fail the test.