Researchers say the app steals data, images and messages from Android phones and can even take over the devices to record.