Innocent-looking apps with ad clicker malware have bypassed Google’s safeguards