Hackers who previously targeted Uyghurs evaded Google Play security checks to push a fake Signal app for Android. It uses a never previously-documented method to spy on the encrypted comms tool.