The attackers are using legitimate-looking apps (such as utility apps, password managers, app launchers, or data savers), where users are lured into downloading malicious apps laden with malware.