WateryRaccoon

Thank you for this insight. Because it's being installed on the order of 100,000's of people, and it all started on October 30th, I believe there is some specific event that set this off rather than a bunch of accidental or misled installs.

The utility of the app only exists in specific habitats.

Indonesia was, I believe, in the top 5 countries as far as install count. Knowing that 3rd party app stores are common gives us another avenue to explore. A buggy or exploitive 3rd app store could explain at least the attack vector, if not the actual objective behind this.

Interesting.. I don't think this would explain the users who claim the app keeps coming back after they've removed it? Is installing Android from another user's image a popular thing?

We're prepared to do this if necessary, but most of these users aren't actually using the app. So the only apparent damage is them getting upset that the app keeps reappearing on their phone.

The app has been unlisted from the problematic countries. The installs are not coming from the Play Store but rather somehow the APK is being installed directly to the phones. I don't know of a way to block this from occurring.

One theory we came up with is that our competition could be trying to get our app marked as spam or malware, and thus booted from the Play Store. If they have some sort of exploit that allows them to install arbitrary .apks on hundreds of thousands of Android devices, which seems probable if this is a malicious attack, it's unclear to me what we could do to prevent them from spamming our .apk to these users.

We do have ads for our unregistered and free users. Our ad campaigns are all handled in-house.

No. The app can be used without signing up at all. After you sign up, you are required to verify your email address (via email, not SMS) to receive a free trial which we offer.