It’s always apps that you definitely don’t need in the first place. File managers, battery savers, RAM managers, etc. The users who would think to install those kinds of apps, when their phone already likely already has built-in (and probably better) support for that functionality, are the same users malware developers look to target. They’re usually not tech savvy, and less likely to realize that their data’s been compromised, and even less likely to determine who compromised it.