story
This happened to people I know. Some innocent sounding app replaced their launcher and added a fake Gmail widget to their home screen. It prompted them to login and, well, you know the rest.
This would never happen on iOS because you can't change the launcher.