Researchers find Google Play apps with 300K+ downloads that stole bank credentials, posing as QR and PDF scanners, exercise apps, and cryptocurrency w