Infected apps are probably themselves victims of malware, say Sophos Labs researchers