Researchers have discovered multiple Android apps, some that were available in Google Play after passing the company’s security vetting, that surreptitiously uploaded sensitive user information to spies working for the North Korean government.

While ad fraud doesn’t get the same attention as phishing and malware attacks, it operates at a massive scale, and it downgrades your experience on your phone and on the apps you use. It also generates millions in fraudulent revenue for attackers, and those funds are often put to much more dangerous use.

KoSpy masqueraded as utility apps, according to Lookout Mobile Security, which links the activity to a cyber-espionage campaign out of North Korea.