Android Malware?
I found Android sucked due to the restrictions of the handset and service provider's modifications to the supplied phone. I don't think Android itself has much in the way of issues. I stopped all the background stuff that the service providers run by rooting the phone and running a custom ROM (Cyanogen mod) and I haven't had a problem with any odd behaviour, malware or anything. I would say my phone has been more stable over the last year than any desktop operating system I have used.
I think it's more that the service providers interference with Android which tends to throw a spanner in the works for a small group of Android users. Friends and colleagues with iPhones have switched to Android and they think it's an improvement. As for WP8, they just will not switch to it based on their experience of desktop Windows. Maybe that is a bit prejudiced towards Windows, but that is down to the user experience of people not wanting endless updates every 12 hours.
Just to note, many Android users (including me with the phone as supplied and tweaked by my service provider) do not receive updates because service providers turn off the OTA (over the air) update service for many and exercise their own controls. It is in their interest to try and make you upgrade handset and get locked in to a new contract for 18 months to 2 years. It is this that prevents patches being available to many Droid users, not so much anything else.
Having a rooted phone on Cyanogen gives access to nightly builds and regular patches, which I have to say are not really required. I just move between major revisions when they are officially released and that's more than enough.