Up to 10 million Android smartphones have been infected by malware that generates fake clicks for adverts, say security researchers.

The software is also surreptitiously installing apps and spying on the browsing habits of victims.

The malware is currently making about $300,000 (£232,000) a month for its creators, suggests research.

The majority of phones that have been compromised by the malicious software are in China.

A spike in the number of phones infected by the malware was noticed separately by security companies Checkpoint and Lookout. The malware family is called Shedun by Lookout but Hummingbad by Checkpoint