A password will be e-mailed to you.

Researchers at an internet security company named Zscaler recently discovered a fake “System Update” application on the Google Play Store. The counterfeit updating application included the SMSVova spyware, and has been on Google Play since 2014.

“There are many apps on the Google Play store that act as a spyware; for example, those that spy on the SMS messages of one’s spouse or fetch the location of children for concerned parents. But those apps explicitly state their purpose, which is not the case with the app we analyzed,” Zscaler stated. SMSVova is spyware that was created to track the location of users in real time and is controlled by hackers using text messages. It is unknown what is done with the location data, but many malicious crimes can take place.

Astonishing, the application had been downloaded between one and five million times. It is believed the malicious software evaded the Google Play filters because it was uploaded back in 2014 before the measures were instituted. Thankfully, the app has been immediately yanked from the Play Store after the report.