Google Play caught hosting an app that steals users’ cryptocurrency