Malicious apps bypassed Google Play security, leading to 60M downloads and fullscreen phishing scams targeting users.