Once it has wormed its way on to your phone, without you noticing, it can turn it into a 24-hour surveill