The theft appears to have occurred on unofficial APK package downloads that were hijacked and installed with code implanted by hackers.