Cybercriminals increasingly use fake VPN apps to spread malware and launch other attacks. This is what's at stake.