This has happened more than once. Good article covering the basics of what to do to try to keep phone safe.

"According to an article on arstechnica.com, Google examines all apps uploaded to Play (they use a cloud service called Bouncer to verify new apps against known malware signatures and test them for malware-like behavior). In this instance the BadNews-related apps were clean upon upload. The designers introduced the malware components to these programs several weeks later."
Malware in the Google Play Store: Enemy inside the gates | TechRepublic