Doctor Web cybersecurity experts: The malware has been downloaded from the official Android AppGallery. Main function: to subscribe users to paid mobile services.
Doctor Web cyber security experts: A copy of the NordVPN official website hosts the dangerous banking trojan, Win32.Bolik.2. Early this year the same group did the same with VSDC.