"I am betting that the users of those phones downloaded some malicious Android app in order to avoid paying for a legitimate version and they got more than they bargained for."

Not using a vetted marketplace is a dangerous security gamble as the author claims the passwords were probably taken by a keylogger.