Malware dubbed PowerOffHijack hijacks the shutdown process of user’s mobile phone. Malware mimics shutdown animation and the device appears to be off, but actually remains on, giving the malicious program freedom to move around on the device and steal data. The malware has already infected more than 10,000 devices, mostly in China where the malware was first introduced and offered through the local, official app stores. The code appears to contact Chinese services, according to the security firm.
Source: https://thehackernews.com/2015/02/poweroffhijack-android-malware.html