MSSPs on notice as cyber mercenary group Bahamut targets Android users with fake VPN apps to steal confidential data, ESET reports.