They pay developers of popular apps to add their botnet code to the app for money. As a result the app becomes botnet on next update.