Starting in May 2019, the xHelper Trojan has been attacking Android users. Since then, its activity has increased significantly, and now it is listed as one of the 10 most frequently detected mobile threats. The Trojan is very difficult to remove.

Symantec reports that 45,000 devices are infected with the virus, and on average 131 mobile devices are infected per day. The source of the infection was narrowed down to websites with applications from outside of the Google Play Store.
MalwareBytes experts say the Trojan is distributed through fake gaming sites. In contrast, Symantec claims that xHelper is downloaded by a malicious system app.

Currently, antivirus software cannot cope with the above threat. Simply removing the infected application is insufficient, the Trojan stays on the device’s system, and even restoring the device to factory defaults does not help.
xHelper only displays ads, however it is not said that it can pose a much greater threat. Analysts have observed the Trojan is still under development, its code has a lot of unused variables with the string Jio in the name. It should be noted that Jio is the second largest telecommunications operator in India, and xHelper mainly attacks smartphones in Russia, India and the United States.