Android malware loots bank accounts and factory resets your phone — and it's spreading