Twenty-eight of them sold the same scam under one name. Five of them quietly installed a bank account thief. Fifty of them planted a rootkit that survives a factory reset. Google and Apple pulled every one of these apps this year, but removal doesn’t reach the copy on your phone. Here’s the list, the one rule that catches most of them and the five-minute check.