A rogue Android app previously available on Google Play has been making millions of fraudulent purchases and sending your data back to ad networks. Here’s what you need to know.