That second stage application then collects additional information, including product identification, phone model, language used on the phone, country information and userIDs, Lookout wrote. It can also silently download other applications.
"The first phase of the malware served to gain root access on the device while the second phase predominantly serves to maintain a connection to the command-and-control server to download and install other files," Lookout wrote. "Because we have not seen the command-and-control server issue commands to download additional applications we cannot divine their exact purpose. However the possibilities are limitless."
"DroidDream could be considered a powerful zombie agent that can install any applications silently and execute code with root privileges at will," Lookout wrote.
Google has taken the affected applications, many of which were legitimate applications that had been modified with DroidDream, out of the Android market. It banned the publishers of the tainted applications and contacted law enforcement, it said.
The DroidDream incident marks the first wide-scale infestation of Google's official Android Market with malware, although there have been prior instances of tampered applications.
Google does little vetting of the Android Market, saying it wants developers to be able to quickly get applications in the hands of users. Nonetheless, "security is a priority for the Android team, and we're committed to building new safeguards to help prevent these kinds of attacks from happening in the future," Cannings wrote.
Send news tips and comments to email@example.com.