[mmrasheed]

Wouldn't it be much easier to buy some of the leaky/crapy but popular apps, and then infect the target phones? Or, perhaps develop few apps providing free backup/storage/VPN/proxy services? There are so many small companies provide phone backup services who technically ask for all critical permissions in the phones. There are many flash light apps who ask for so many unnecessary permissions, yet their downloads are in millions.

Certainly, Apple app screening would be pain in the a$$, but Google play store is still very flexible.