The victim clicks on the shared link and downloads the malicious APK (outside the Play Store), and when installed, the app asks for dangerous permissions ...