Fake hospital booking apps distributed via search results hijack mobile devices to read text verification codes and drain linked payment accounts.