Microsoft highlighted a shift in tactics, with attackers directly sharing malicious APK files