This is true, as it is with any "Trojan Horse" type program, whether delivered through email, script, even some executables that can be hidden in some types of graphic files. If you download and install, or execute something you are not 100% sure of, you are at risk.

This flashlight hack is pretty basic stuff as well, not that sophisticated at all, but it doesn't need to be, because most want a that type of app and enough will download it.

Another app that's known as malware are many traffic apps, especially one's tagged for specific cities, will re-route you based on traffic reports. They piggy back on a known traffic app, put a city specific tag on it and once again, enough will download it that you're identity will get captured.

This is fun stuff...some of the stories I could tell....LOL!