Toxic Android password stealer only needs to send a single SMS text message to entrap victims. What you need to know and do.