Malware has infiltrated a popular Android app with more than 100 million downloads on Google Play.

The free app, CamScanner, converts images you take with your phone into PDF documents. According to security firm Kaspersky Lab, the app itself is safe; the problem deals with a third-party advertising library on CamScanner that secretly installed malware on victims' phones.

The library did this by decrypting a Zip archive in the app, which then downloaded additional files from several hacker-controlled servers. "As a result, the owners of the module can use an infected device to their benefit in any way they see fit, from showing the victim intrusive advertising to stealing money from their mobile account by charging paid subscriptions," Kaspersky Lab said.

The security firm reported its findings to Google, which took the app down. Similar variants of the malware have also been detected in apps preinstalled on Chinese-made smartphones, Kaspersky Lab said.

On Wednesday, CamScanner, which comes from a Chinese company called CC Intelligence Corporation, confirmed that the app had been infiltrated with malware. The malicious code was sourced back to a third-party ad software development kit from a provider called AdHub. Specifically, the malicious module was focused on producing "unauthorized advertising clicks," CamScanner tweeted.

"We will take immediate legal actions against Adhub! Fortunately after rounds of security check, we have not found any evidence showing the module could cause any leak of document data," CamScanner said.

The malicious ad library was embedded in CamScanner starting with version 5.11.7, which was released last month. The affected ad library has been removed, and CamScanner has uploaded a new version of the Android app. It's not yet available on Google Play; if you don't want to wait, there is a link on the CamScanner Twitter feed.

Although the Google Play Store is generally free of malware, hackers can sometimes sneak nefarious apps onto the platform. For added protection, consider trying a third-party antivirus Android app.