Password managers can be tricked into believing that malicious Android apps are legitimate