You install an app from the Play store that is very normal, it only requests Internet permissions. Then after a week or so, it wakes up and downloads its paylo

You install an app from the Play store that is very normal, it only requests Internet permissions. Then after a week or so, it wakes up and downloads its payload which with it can modify itself, transforming itself to seemingly be the Gmail app you are so often using, while moving the real gmail away. Then you continue using and updating "gmail" like you normally would, except you know, its now using a proxy and no ssl.