We previously reported that a security flaw was discovered that could potentially affect millions of devices running the Android operating system, and was subsequently patched by Google. Symantec reports they've found apps that are using the vulnerability.
Using their system which automatically analyzes Android apps from hundreds of marketplaces, they found two apps that are using the "Master Key" vulnerability in a malicious manner. The apps are legitimate, but have been modified by hackers. Both apps were found in the Chinese marketplace and are used by people to schedule doctor appointments.
An attacker has taken both of these applications and added code to allow them to remotely control devices, steal sensitive data such as IMEI and phone numbers, send premium SMS messages, and disable a few Chinese mobile security software applications by using root commands, if available.
Symantec also states that the expect other attackers to use this vulnerability for malicious purposes, and recommends only downloading apps from reputable Android app stores.