The threat actor could also hide the payload within encrypted .dex files or regular .dex files within images using steganography. Either way, after installation, applications infected with Joker run a scan using Google Play APIs to see if it is the latest version of the app.

Read full article on HotHardware