The Expensive Wall malware or virus automatically registers victims to premium services without their permission or knowledge and send fake messages, then charge their accounts. So, the people who code the Malware will steal data and at same time scam people.
Any application with expensive wall malware request the SMS permissions to join to a server at regular interval. In fact, they run what is sent by the server in a webview.
Meanwhile, the malware is "packed" which means that the malware developer has hide the function of the software that has the malware on playstore in other for Google not to notice.
However, Google play protect - is a user-friendly security screening app that scans what you install to find risks, has been fooled by the malware because the malware has been packed by the malware developer and therefore, up to 5 or 20 million has been affected on playstore.
But the malware app will be removed after Google play protect has been upgraded to detect the "packed"malware. It's just a matter of time.
