“Currently in the beginning of June 2023 it has over 5 million install base on android and even if you split it by 10 it has a potention of 500k RPS.”
Swing VPN pulls attack targets from GitHub and Google Drive and fires a heavy request at them every few seconds from every phone it runs on. The first victim spotted was a Turkmenistan Airlines flight search page. The attack starts while you are still reading the privacy policy, before you tap accept. Play Store review let a 5-million-install botnet through because each phone only sends one request every 10 seconds.