Google found at least 50 malicious apps being sold at its Android store, which customers downloaded on 260,000 smartphones before the breach was discovered.