Malware hits millions of Android users — delete these apps right now

Green skull on smartphone screen.
(Image credit: Shutterstock)

Update August 1: There's a new report of auto-starting Android malware infecting millions of devices. And we have a list of more apps you'll want to delete. 

Another batch of malicious apps filled with adware and malware has managed to slip past Google’s defenses and end up on the Play Store.

In order to trick unsuspecting users into downloading them, these 36 malicious apps pose as image-editing tools, virtual keyboards, system optimizers, wallpaper changers and other useful tools. 

While these apps promise to add new functionality to your Android smartphone, they actually push intrusive ads, subscribe users to premium services and steal social media accounts instead, according to BleepingComputer.

The malicious apps were discovered by security researchers from the antivirus software maker Dr. Web who provided further insight on each of the individual apps in a new report.

Although Google has removed most of these bad apps from the Play Store, you will still need to uninstall them manually if you have any of them on your Android devices.

Delete these Android apps: Full list 

  • Photo Editor: Beauty Filter 
  • Photo Editor: Retouch & Cutout 
  • Photo Editor: Art Filters 
  • Photo Editor - Design Maker 
  • Photo Editor & Background Eraser 
  • Photo & Exif Editor 
  • Photo Editor - Filters Effects 
  • Photo Filters & Effects 
  • Photo Editor : Blur Image 
  • Photo Editor : Cut, Paste
  • Emoji Keyboard: Stickers & GIF
  • Neon Theme Keyboard 
  • Neon Theme - Android Keyboard 
  • Cashe Cleaner
  • FastCleaner: Cashe Cleaner
  • Call Skins - Caller Themes
  • Funny Caller 
  • CallMe Phone Themes
  • InCall: Contact Background 
  • MyCall - Call Personalization 
  • Caller Theme
  • Caller Theme 
  • Funny Wallpapers - Live Screen 
  • 4K Wallpapers Auto Changer
  • NewScrean: 4D Wallpapers
  • Stock Wallpapers & Backgrounds 
  • Notes - reminders and lists 

Adware apps that keep running in the background

Generic ads displayed on the screens of a generic smartphone and tablet.

(Image credit: BestForBest/Shutterstock)

In addition to just being annoying, adware apps can quickly drain your smartphone’s battery as many of them are designed to continue running in the background even after you close them.

The ones discovered by Dr. Web are actually modifications of existing adware families that first showed up on the Play Store back in May of this year.

These adware apps are also able to run on top of other apps as they request permission to use overlay windows during installation. However, they can keep running in the background as well by adding themselves to the battery saver’s exclusion list in Android.

To make matters worse, many of these adware apps also feature the ability to hide their app icons in the app drawer or replace them with a different icon that resembles a core system component such as “SIM Toolkit”.

Of these adware apps, Neon Theme Keyboard by Nataļja Kokorevičs (which is still up in the Play Store at the time of writing) stands out as it has over a million downloads even with a terrible score of 1.8 based on 4,000 reviews. Fortunately though, it does seem like Google Play Protect has begun warning users about the app based on reviews from the Play Store.

Joker apps that subscribe users to premium services

Dr. Web’s researchers also found malicious apps on the Play Store that infect users’ devices with the infamous Joker malware

These apps are particularly dangerous since this malware strain has the ability to sign up victims to premium subscription services without their knowledge. Unfortunately, two of the malicious apps in Dr. Web’s list (Water Reminder- Tracker & Reminder by YPC Dev and Yoga- For Beginner to Advanced by ALHASSAN) are still available to download and have yet to be removed from the Play Store.

Although both apps actually provide the functionality described in their Play Store listings, they also perform malicious actions in the background.

Image editing apps that steal your Facebook account

Facebook app on phone

(Image credit: Shutterstock)

Having your Facebook account hacked can be devastating, especially when it’s a Facebook Business account, which is why two of the malicious apps discovered by Dr. Web’s researchers need to be uninstalled immediately.

These two apps (YouToon – AI Cartoon Effect and Pista – Cartoon Photo Effect) disguise themselves as image editing tools that can apply cartoon filters over regular images and have been downloaded from the Play Store over 1.5 million times.

Both apps have been designed to steal data from your Android smartphone that can be used to hack into your Facebook account.

Protecting yourself from malicious apps on the Play Store

In order to avoid intrusive ads, being subscribed to premium services against your will or having your social media accounts stolen, the first thing you should do is look through the list above to make sure that none of these malicious apps are installed on your Android smartphone or tablet. 

If they are, remove them immediately and consider using one of the best Android antivirus apps to look for any viruses that may have been left behind.

At the same time, you should also avoid installing apps from unknown sources and instead download them from official stores like the Google Play Store, Amazon App Store or Samsung Galaxy App Store. 

Even then, bad apps do manage to slip past Google’s defenses from time to time which is why you should always check user reviews and ratings, visit developer websites and read the privacy policy of every app you install. I know it’s a lot but it’s worth doing if you want to be on the safe side.

Finally, you should ensure that Google Play Protect is active on your devices as it regularly checks for malicious apps and warns you if you try to install one.

Anthony Spadafora
Managing Editor Security and Home Office

Anthony Spadafora is the managing editor for security and home office furniture at Tom’s Guide where he covers everything from data breaches to password managers and the best way to cover your whole home or business with Wi-Fi. He also reviews standing desks, office chairs and other home office accessories with a penchant for building desk setups. Before joining the team, Anthony wrote for ITProPortal while living in Korea and later for TechRadar Pro after moving back to the US. Based in Houston, Texas, when he’s not writing Anthony can be found tinkering with PCs and game consoles, managing cables and upgrading his smart home. 

Read more
Green skull on smartphone screen.
Malicious Android apps with 60 million installs bombarding phones with ads and phishing attacks — how to stay safe
and image of the Google Chrome logo on a laptop
Popular Chrome extensions hijacked by hackers in widespread cyberattack — 3.2 million at risk
Google Play logo on an android smartphone with corner hole punch camera
At least 5 North Korean spy apps have been found on Google Play — what you need to know
One phone with skull and crossbones on screen among several other clean-looking phones.
Malicious iPhone apps are spreading screenshot-reading malware on the Apple App Store — how to stay safe
Best Android antivirus
The best Android antivirus apps in 2025
An image of a Google Android robot
Google blocked over 2.5 million suspicious Android apps from the Play Store last year
Latest in Malware & Adware
Green skull on smartphone screen.
Malicious Android apps with 60 million installs bombarding phones with ads and phishing attacks — how to stay safe
Malware
Dangerous new password-stealing trojan automatically reinstalls itself on infected PCs
An FBI agent typing on a computer
FBI issues warning to millions of Americans to avoid these websites that can steal your passwords and banking info
A hacker typing quickly on a keyboard
New MassJacker malware is hijacking digital wallets to steal large sums from users
A person trying to set up a new Wi-Fi router
Thousands of TP-Link routers have been infected by a botnet to spread malware
A smartphone screen displaying the Android name and logo next to a sign reading 'MALWARE'.
Fake Google Play Store pages are spreading Trojan malware that can steal your financial data
Latest in News
Nintendo Switch 2
Nintendo Switch 2 pre-order date just tipped — here's when you might be able to buy
Android 16 screen-off fingerprint unlock in Settings menu
Android 16's latest beta lets all Pixel users unlock their phone more easily — here’s how
Max Rockatansky (Tom Hardy) stands on the hood of a car with an explosion behind him in a promotional still for Warner Bros. "Mad Max:Fury Road"
One of the best action movies ever made is leaving Netflix very soon — here's your last day to stream 'Mad Max: Fury Road'
nvidia rtx 50 series
RTX 5060 Ti release date just tipped for April 16 — HP seemingly confirms Nvidia's next-gen GPUs
Ray-Ban Meta Smart Glasses
Samsung’s 'Haean' smart glasses will reportedly launch this year — here's everything to expect
Foldable iPhone concept image
Apple's foldable 'iPhone Flip' tipped for release in 2026 with a familiar design and iPhone 17 Air features