Distribution of these fake VPN apps occurs through two main methods: Phishing: Users receive deceptive emails, text messages, ...
It is far from the first time that Google has had to clean up fake malicious apps on the Play Store ... as a battery monitor and sent premium-rate text messages from people's phones.