Designed to steal usernames and passwords for banking apps, the malware was hidden in apps in the Google Play Store.