The discovery demonstrates limitations in Google Play's antimalware service.

The code family used to push malware circulated as early as June 2012.

Covert remote access trojan was built using newly discovered DIY toolkit.

Titles raise questions about Google's ability to police its own market.