A counterfeit Google Play Protect lure shows how mobile malware can use familiar brands, accessibility abuse, and overlays to pressure users into handing over financial access.