The app, downloaded more than 10,000 times, avoided detection by masquerading as a harmless calculator tool.
