How did Kaspersky identify this ?
I suppose it is too much to ask that their Android AV solution on someone's affected device phoned home with this ?
Of those 100M downloads at lease one must have been running their security suite (in other words, don't just blame Google for missing this, you would like to think Kaspersky were suddenly inundated with reports of malware from their own product).