Nefarious Android app hijacks millions of services with a single update