MalBus is Android malware inserted into otherwise legitimate South Korean applications after an attacker compromised a developer’s accounts and source-code access. Malicious versions of transportation and education apps were distributed through major Korean app stores, downloaded encrypted follow-on payloads from compromised servers, and installed a trojan masquerading as a plugin. The payload could phish Google credentials and take extensive control of infected devices, while later clean versions and store removals curtailed distribution.