A popular, once legitimate, Android app infected millions of Android devices with Malware.

The app was called Barcode Scanner and was originally published by a developer called Lavabird.

But after a December 4th update, users were flooded with pop-up ads that took over their devices. So how did this happen? According to Malwarebytes, the folks at Lavabird told them they both develop and buy and sell apps.

They purchased the QR code scanner app and sold it to another company called Space Team. Space Team then updated the app and infected it with malicious code.

This doesn’t mean that all QR scanner apps are infected. There are dozens of QR code readers in the Google Play Store. Only the app from Lavabird or Space Team as the developer is affected.

Google removed the app from the Play Store. If you think your device may have been infected, remove the app and run a security app like Malwarebytes.