Kaspersky has detected a range of new mobile threats, including a VPN app that intercepted login codes sent through text messages.