Found: 280 Android apps that use OCR to steal cryptocurrency credentials

Because usually those are masquerading as legitimate apps.

Real example: Google allows "Muhammad mahmood ali" from Pakistan to run fake ads pretending to be a more famous corporation (flagged, google replied that this individual isn't breaking the TOS somehow, flagged again, the bot replied that yes, that phishing page doesn't break AdWords TOS - probably the scammers are serving different content according to the IP address)

When someone searches for "dji app", they get an ad that looks legitimate and goes to a fake landing page where they say to download and install this apk, showing a fake "100% safe and trusted" logo.

So, they can't say the list of the infected apps, because the real apps aren't affected. Someone could have been tricked by a fake ad to install an infected version of "bank of America" but the real app is clean