Android’s history with malicious apps is no secret. The platform has seen a lot of malicious apps being available to users via the Play Store, even with its Play Protect service in full swing. In a new blow to the operating system’s user-protections, researchers have found out that a third party app with over 40 million downloads on the Play Store has been secretly signing up its users for premium purchases in order to make money.

The app in question is called Ai.type — a third party keyboard app that claims to use AI to learn users’ writing styles in order to help them write faster over time. Mobile tech company Upstream highlighted the issue, and pointed out, rather worryingly so, that the app is still active on millions of devices even though it was removed from the Play Store in June this year.

Apart from signing up its users to premium purchases, the app reportedly also shows invisible ads and generates clicks on them to earn money. What’s more, the app requires invasive permissions, including access to the user’s photos, messages, videos, and contacts.

“Ai.type carries out some of its activity hiding under other identities, including disguising itself to spoof popular apps such as Soundcloud. The app‘s tricks have also included a spike in suspicious activity once removed from the Google Play store” said the researchers.

Upstream detected and reported 14 million suspicious transactions from the app, which, had they not been blocked by the company, would’ve resulted in a total of $18 million in unwanted charges.

If you are, or someone you know is, using Ai.type on their smartphone, it would be best to delete the app as soon as possible from your phone. Plus, it’s always a good idea to avoid sideloading apps on your smartphone, and even for apps downloaded from the Play Store, you should always check the permissions it’s asking for, and why it needs them.