A spyware scare has led Google to remove over 500 apps from its online app store.
The decision comes after researchers from cybersecurity firm Lookout disclosed this week the discovery of more than 500 apps available through Google (GOOG) Play that could spread spyware on mobile phones.
Certain software used in the apps had the ability to covertly siphon people’s personal data on their devices without alerting the app makers, Lookout said. Many app developers were probably unaware of security flaws, the company added.
Lookout identified two of the affected apps as Lucky Cash and SelfieCity, both of which were subsequently fixed. The firm did not reveal the other impacted apps, but said they included mobile games for teenagers, weather apps, online radio, photo editing, education, health, fitness, and home video camera apps.
Get Data Sheet, Fortune’s technology newsletter.
All of the impacted apps used a software development kit (SDK) that helps companies target people with ads within the apps based on people’s preferences, as gleaned from their user data. Lookout researchers discovered that the Igexin advertising SDK embedded in the apps caused those apps to communicate with outside servers that the security firm said had previously served malware to people.
Although it’s not unusual for apps to occasionally communicate with those servers, the Lookout researchers noted a strange instance where an app appeared to be “downloading large, encrypted files” from those servers. This action tipped the researchers off that hackers were exploiting a bug in the SDK that could spread malware after the app is installed on a device.
Although app developers are required to notify users about how they collect data, Lookout said it’s likely they were unaware that the Igexin SDK could open the door to malware. Lookout researchers said they notified Google of the security flaws they found, and that Google followed up by removing the apps from the Play Store or replaced those apps with new versions that do not have the same cybersecurity vulnerabilities.
Earlier this month, Google and Apple (AAPL) removed over 330 financial trading apps from their online stores following a review by the Australian Securities and Investments Commission. The Australian regulator discovered that many of those app operators did not have the appropriate license required to operate those financial apps, and that they failed to disclose financial risks to their users.
