McAfee reported that malicious Android code was delivered through a plugin masquerading as part of a long-running South Korean bus app series. The apps had been available through Google Play for years before removal, giving the attacker a trusted distribution context. The case highlights mobile supply-chain and plugin abuse risks where users install software tied to a familiar regional transportation service.