[ian0]

Third party app stores are common here in Indonesia, while working on a previous app we found ~20-30% of users installed APKs via them.

They were the lowest converting segment, this was related to the demographic (rural & lower income). People were installing without understanding what the app did, subsequently uninstalling again as memory is scarce. Its hard to understand, but sometimes people just browse and download things out of boredom, curiosity or because they misunderstand what the app is for.

We also had complaints like yours "I didn't install this app" but when we contacted them direct (googled name, sent email/FB message) we often found that a spouse / kid had done so. Shared phones are common.

Im not sure if this could be related to your circumstances, it depends on the type of app you have. Also if its something that a kid may download, recent events may contribute. With covid there are lots of kids using their parents devices at home, with low cost / free data plans in place to support online schooling.

[WateryRaccoon]

Thank you for this insight. Because it's being installed on the order of 100,000's of people, and it all started on October 30th, I believe there is some specific event that set this off rather than a bunch of accidental or misled installs.

The utility of the app only exists in specific habitats.

Indonesia was, I believe, in the top 5 countries as far as install count. Knowing that 3rd party app stores are common gives us another avenue to explore. A buggy or exploitive 3rd app store could explain at least the attack vector, if not the actual objective behind this.