>These malicious updates collect data about the users that the threat actor, which Trend Micro calls the Lemon Group, can sell to advertisers.

Sorry but this sounds like Google or FB, I expected way worse unless Google and FB services are considered as malware as well