A stealthy malware campaign on Google Play rooted over 2 million Android devices and stole WhatsApp data-while users were none the wiser.