BaFin said that it was unclear how the malware infected consumers' devices.

The malware displays fake websites of regular apps that can collect user login details and transmit them to cyber criminals, BaFin said.

(Reporting by Tom Sims and Marta Orosz; Editing by Miranda Murray)