[WateryRaccoon]

Thank you for this insight. Because it's being installed on the order of 100,000's of people, and it all started on October 30th, I believe there is some specific event that set this off rather than a bunch of accidental or misled installs.

The utility of the app only exists in specific habitats.

Indonesia was, I believe, in the top 5 countries as far as install count. Knowing that 3rd party app stores are common gives us another avenue to explore. A buggy or exploitive 3rd app store could explain at least the attack vector, if not the actual objective behind this.