A new variant of the DroidKungFu Android Trojan is posing as a legitimate application update in order to infect handsets. The update only asks for access to SMS/MMS messages and location, but also contains a root exploit for Android 2.2 (Froyo) The update is distributed with the help of a non-malicious application currently available from third-party app stores in China. The threat is global because apps infected with earlier versions of the Trojan have been detected on the official Android Market.”]
Source: https://www.csoonline.com/article/2129953/exploit-powered-android-trojan-uses-update-attack.html