It started innocently enough. A new app, a few megabytes, seemingly from a legitimate developer. But behind that blank icon or familiar Google Play logo ...