Remember Ghost Push? The malware that started threatening all Android devices about two years ago has come back to haunt the global Android community. Google has verified the existence of a new variant of the Ghost Push malware named Gooligan. The malware was first discovered by Check Point, a security research firm. The report says that over 1 million Google accounts could have been affected by the threat and the number is increasing with about 13,000 account breaches every day.

According to Checkpoint, the malware infects devices and steals information that further helps it to access data from Gmail, Google Play, Google Photos, Google Docs, G Suit, Google Drive and more.

Adrian Ludwig, director of Android security at Google, confirmed the Checkpoint report and said that his team is working closely with the security firm.

How does Gooligan work?

Gooligan is a variant of a family of malware called Ghost Push. In simpler words, Ghost Push is a collection of harmful apps, which usually find their way to Android devices through downloads from third-party app sites. Once installed, these apps secretly download other apps, which are not visible to the user.

Also read: How to protect you data and avoid being hacked

Once these other apps, which are phishing campaigns, work with the original malware to collect user's data including account authentication tokens. All this while, the malware stays in contact with its maker. And you guessed it right, all your information is sent to this hacker sitting at a remote location.

Who is affected?

According to the findings, the affected devices run on Android 5 and lower. Unfortunately, 74 per cent of the Android devices in the market are running on these Android versions. Of these affected devices 57 per cent are in Asia, 19 per cent in the US, 15 per cent in Africa and 9 per cent are in Europe.

Ludwig has said that the company hasn't found any "signs of other fraudulent activity within the affected Google accounts". He says that the aim of Gooligan could possibly be app promotion and not steal information.

Also read: Love your Android phone? Never click yes on this pop-up

How to know if you are affected?

Checkpoint has created a website, www.gooligan.checkpoint.com, to check if your Android devices is affected or not. Here is what to do if you device is one of the affected ones:

-- The best course of action is to flash your device, which means a clean installation of the operating system. If you are sure you can do it, go ahead, else take the phone a technician.

-- Once you have a clean Android, change your Google account password immediately.

These steps will ensure some level of safety for now, but for future we strongly suggest you to:

-- NEVER install any app that is not coming from a verified developer.

-- Not to click on pop-up ads.

-- Not to open mails that are coming from unknown sources or are coming from a suspicious ID.

-- To keep changing passwords on all accounts, which means Facebook, Google, Twitter and the likes.