Google Play Protect has removed 1.7k Bread apps from the Play Store before ever being downloaded by users. Bread apps originally performed SMS fraud, but have largely abandoned this for WAP billing following the introduction of new Play policies restricting use of the SEND_SMS permission and increased coverage by Play Protect. The apps have used many innovative and classic techniques to hide strings from analysis engines. They have at some point used just about every cloaking and obfuscation technique under the sun in an attempt to go undetected.”]
Source: https://security.googleblog.com/2020/01/pha-family-highlights-bread-and-friends.html