> Even malware, that should be way easier to detect and stop , way easier than to stop a pop-up asking for your credit card, pass thru their system

Ah yes, one of the scarier trojans to hit your phone: click-jacking for ad fraud.

> The apps communicate with a known command and control (C&C) server to simulate user interactions in order to fraudulently collect ad revenue.

I'd download this malware any day over the actually-malicious Android malware that's out there: https://forensics.spreitzenbarth.de/android-malware/