[rsy96]

The "malware" can do two things: send tracking information to a server, and show popups (which may be spoofed as login dialogs). Both of these are entirely possible to be intended by the app authors, and in that case, it would be considered a feature. So it is almost impossible for anyone other than the app authors to find out it has been infected.