Fraudulent Android apps disguise themselves as everyday utilities to abuse the SYSTEM_ALERT_WINDOW system permission and deliberately display ads immediately after phone calls.