This just popped up, using TrustGo

[ATabby]

it says low risk and it can give my GPS location.   how come it just got found When I've been using Aqua Mail And TrustGof for months.  Quite frankly I'm not at all worried. 

[Thomas]

This is defenitive a false alarm.

Quote of permissions from AquaMail:

NETWORK COMMUNICATION
FULL NETWORK ACCESS
Allows the app to create network sockets and use custom network protocols. The browser and other applications provide means to send data to the internet, so this permission is not required to send data to the internet.
CONNECT AND DISCONNECT FROM WI-FI
Allows the app to connect to and disconnect from Wi-Fi access points and to make changes to device configuration for Wi-Fi networks.

And what the hack is "PUA!Twofeo.A@android"
Do you have any PUA apps installed?
https://www.google.com.ar/search?q=PUA+ANDROID+APPS&oq=PUA+ANDROID+APPS

[Kostya Vasilyev]

Yes, this is a false positive. AquaMail has no permission to get GPS location, you can check this yourself in system settings -> apps management (or Google Play on the web).

Already reported to TrustGo, and fixed by them in a virus update a few days ago.

This is from July 3rd:

Hi there,

Thanks for contacting TrustGo support team! My name is Keith and I'm glad to assist you.
 
We have identified an issue in recent virus signature update, and we will publish a virus definition update today to fix them. The new signature will be pushed to each device in 3 - 4 hours automatically. You are highly recommended to scan your device again to see the correct scan results.
 
Please accept my sincerely apologies and we will take immediate actions to avoid such issue from happening again. If you have any question or need further assistance, please reply to this email.

Best regards,
Keith