Malicious smartphone tools are being distributed through Samsung’s Galaxy App store, These apps don’t contain hostile code, but their structure suggests that they do act as a gateway towards more serious mobile malware.

Two of the apps can do dynamic code execution, which means they can download and execute other, potentially malicious code, there arent much real use cases for this functionality as well as the fact that it could be weaponized, it’s safe to assume that was the point, in the first place. So at any moment it may become a trojan/malware, hence it’s unsafe and thus why so many vendors flagged it in VT/Play Protect.

The good news is that Google’s Play Protect, a mobile antivirus that scans incoming apps for signals of trouble, initiates a warning when the user tries to install any of the apps. The bad news is, given that the apps reside on Samsung’s official store, people could be ignoring the warning. Unfortunately, Samsung doesn’t count downloads from its app store, so it’s impossible to say how many people have downloaded those apps.

All of the five apps are clones of Showbox, an app accused of facilitating piracy, but extinct for nearly two years, and is inaccessible.