Reddit user iamtubbeman initially discovered that these groups combine low-level permissions with higher permissions that could be used for more nefarious purposes. For example, an app that can receive an SMS could silently be updated to also send SMS, costing the user money. Likewise, an app that previously used Wi-Fi to find a user's general location, could acquire GPS access to see the user's precise location.