A strain of malware known as FluHorse has been attacking Android users, stealing passwords, 2FA codes, credit card numbers and more.