A new version of the AndroRAT Trojan, SandoRAT, is now infecting Android phones. 99 percent of free mobile apps for both iOS and Android had at least one risky behavior, such as recording unique device identifiers, device locations or contact lists. The granular nature of app and in-app purchases makes more traditional malware delivery methods effectively obsolete. IBM exec: “You are the product that is for sale. It is no longer possible to assume any malice or intent is malicious””]
Source: https://securityintelligence.com/free-mobile-apps-what-is-the-cost-of-these-permissions/