Devices running Android 12 and below are at risk of attackers downloading apps that direct users to a malicious domain.