The malicious apps were not listed on the official Google Play Store and were instead found on third-party app store websites discoverable via Google Search, according to Bitdefender.