KS Clean uses trusted mobile apps to spread malicious adware embedded in the apps. Immediately upon a user clicking on an ad within the app, the malware will be downloaded in the background without the user’s knowledge or permission. A message will then pop up on the user’s screen notifying them of a security issue that they have to fix by updating the app. Once the user clicks “OK,” the malware will be fully downloaded and given administrative privileges. This allows the malware to display several pop-up ads on the user’s device. The attackers can then use the administrative privileges to install more malware.