There's a new threat for Android devices, and it's name is HummingBad. HummingBad is a piece of Android malware that will install a rootkit on your device, which allows it to remotely install unwanted software without your permission. But don't panic, there are measures you can take to protect your data if you think you may be at risk.
The first step is detecting HummingBad. This can be done with any of the reputable security apps available from Google Play, including Lookout, Zone Alarm, AVG, and Avast. Once you've determined that you have HummingBad on your system, however, you have to take a rather destructive approach to get rid of it. The easiest way to remove all traces of HummingBad from your system is a factory reset. Doing this may vary on different devices and Android versions, but typically you will do as follows: find "Backup and Reset" in the settings menu. From here, select "Factory data reset". This will wipe everything from your device, so be sure prior to doing it that you have backed up any data you want to hang on to, including pictures, contacts and text messages. Fortunately, we live in an age where most of our data is automatically synced in real time, so performing a factory reset isn't as overwhelming as it used to be. As long as you have sync services turned on, most of your basics should be covered; when you power your device back on and sign into your Google account, you should see your contacts, calendar events, emails, and apps return to your device (this should be done via WiFi if you aren't on an unlimited data plan). For anything that doesn't back itself up automatically, you can copy the data to your microSD card if you have one, or to your computer using a USB cable.
Once you're back up and running, it may be a good idea to be sure you set up your security application of choice again. Aside from that, the best way to protect against these kinds of threats is to avoid installing apps from unknown sources. Google Play scans apps for malware and will remove anything from the Play Store that appears unsafe, however when you get an app from another source no such protections are in place. If you take these easy measures, you will be better protected from threats in the future. It is always nerve-racking to find out that your security has been compromised, but it's nice to know that all is not lost.