A new version of HummingBad, the malware that infected more than 10 million Android devices in 2016, has been discovered, and like its predecessor it appears to be running riot as well.

Dubbed HummingWhale, the malware has been found hidden in 46 new applications, 20 of which were listed on Google Play. They’ve been downloaded by as many as 12 million unsuspecting users.

“It was probably only a matter of time before HummingBad evolved and made its way onto Google Play again,” Oren Koriat, a mobile cyber security analyst with Check Point Software Technologies Ltd., wrote in a blog post.

Researchers at Check Point made the discovery after they spotted a malicious app that shared many of the same attributes HummingBad had before it. Once a victim downloads an infected app, which includes camera, music, flashlight and adult apps on Google Play, the APK acts as a “dropper,” downloading several additional apps including DroidPlugin, a plugin initially developed by Qihoo 360 for running virtual machines on Android devices. Using that plugin, the hackers behind the malware can generate fake referrer IDs and make money through clicking on ads, as well as by downloading apps that offer pay-per-install affiliate programs.

“First, the command and control server provides fake ads and apps to the installed malware, which presents them to the user. Once the user tries to close the ad, the app, which was already downloaded by the malware, is uploaded to the virtual machine and run as if it is a real device. This action generates the fake referrer ID, which the malware uses to generate revenue for the perpetrators,” Koriat explained.

The virtual machine component makes it difficult for security apps to spot HummingWhale’s malicious behavior and for Google to detect the malicious apps before they are listed in the Play Store. “This is a prime example of malware developers learning from each other, as tactics that were introduced by one of them are quickly adopted by others,” Koriat concluded. “The fraudulent ratings left by such malware is another reminder that users cannot rely on Google Play for protection, and must apply further, more advanced means of security.”

The good news is that Check Point informed Google of the findings and infected apps have been removed from the Play store. But given the malware’s ability to hide in plain sight, it’s highly possible that further infected apps will manage to be listed in the future.

Image credit: Whit Welles/Wikimedia Commons/ CC by SA 3.0