A serious vulnerability that remains unfixed in many Android devices is under active exploit, marking the first known time real-world attackers have used it to bypass key security protections built in to the mobile operating system.

Dirty Cow, as the vulnerability has been dubbed, came to light last October after lurking in the kernel of the Linux operating system for nine years. While it amounts to a mere privilege-escalation bug—as opposed to a more critical code-execution flaw—several characteristics make it particularly potent. For one, the vulnerability is located in a part of the Linux kernel that's almost universally available. And for another, reliable exploits are relatively easy to develop.

By the time it was disclosed, it was already under active exploit on Linux servers. Within days of its disclosure, researchers and hobbyists were using the vulnerability, indexed as CVE-2016-5195, to root Android phones

Now, more than 1,200 apps available in third-party marketplaces are exploiting Dirty Cow as part of a scam that uses text-based payment services to make fraudulent charges to the phone owner, researchers from antivirus provider Trend Micro reported on Monday. The apps, which Trend Micro has detected on 5,000 devices in 40 countries, exploit Dirty Cow to overcome system restrictions and plant a backdoor that gives attackers a way to access the device for future attacks. Although Dirty Cow can be reliably exploited on just about any hardware platform, the exploit Trend Micro documented works only on Android devices with ARM/X86 64-bit architecture. Trend Micro said the apps are members of a family called ZNIU. The security company has published a list of malicious apps here.

To be sure, there are no reports of apps available in the official Google Play market exploiting Dirty Cow. What's more, most of the infections are taking place in China and India. Still, attacks in third-party marketplaces can sometimes foreshadow what's likely to come in Google Play. And while Google released a patch for Dirty Cow last December, it's not clear what percentage of devices are eligible to receive it. Researcher David Manouchehri said it's likely any phone running Android version 5.1.1 or earlier is susceptible, and even phones running later versions may be, too. Based on figures supplied by Google, that would leave at least half of devices vulnerable. Google officials weren't able to provide an estimate of how many devices are patched.

Google-branded phones—including the Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus Player, Pixel, and Pixel XL—should all be immune to attacks, assuming users are installing over-the-air updates on a regular basis. Concerned readers using other devices should check with the manufacturer or carrier to find out if their devices have been patched.