Google explains how Android malware slips onto Google Play Store

To evade detection by Play Store systems, the threat actors responsible for SharkBot have adopted the now common strategy of releasing versions with limited functionality on Google Play, concealing their apps’ suspicious nature.