Google Play has given the boot to 16 apps with more than 20 million combined installations after researchers detected malicious activity that could cause the Android devices they ran on to drain batteries faster and use more data than normal.

The apps provided legitimate functions, including flashlight, camera, QR reading, and measurement conversions, security firm McAfee said on Wednesday. When opened, however, the apps surreptitiously downloaded additional code that caused them to perform ad fraud. From then on, infected devices received messages through the Google-owned Firebase Cloud Messaging platform that instructed them to open specific web pages in the background and select links to artificially inflate the number of clicks ads received.

“Mainly, it is visiting websites which are delivered by FCM message and browsing them successively in the background while mimicking user’s behavior,” McAfee’s SangRyol Ryu wrote. “This may cause heavy network traffic and consume power without user