Malware was disguised as apps Crypto Monitor and StorySavers Both apps have since been removed from Google Play. The code is able to display fake notifications and login forms to harvest login credentials. The same malware was discovered by security firm RiskIQ in November. 96% of the detections come from Poland (the remaining 4% from Austria), apparently due to local social engineering campaigns propagating the malicious apps. The malicious code is also able to intercept SMS messages used by financial institutions.”]
Source: http://securityaffairs.co/wordpress/66659/malware/polish-banks-banking-trojan.html