The app differs from the official version in subtle ways and steals users’ money and sensitive information.