Five applications were discovered to have been carrying a version of the Mandrake Android Spyware on Google Play for two years. During the applications’ time on Google Play, they had over 32,000 downloads. Mandrake is a spyware platform which allows attackers to completely control infected devices. The attackers can record the screen and steal sensitive information to blackmail the victim. The most downloaded infected application is AirFS, which had over 30,000 downloads before it was removed from Google Play. This new version of Mandrake is very difficult for malware analysts to detect.