For four months, a fake wallet app was on the Google Play Store and was downloaded more than 10,000 times, using #phishing attacks to siphon off more than $70,000 in user funds before it was shut down.