This seems like a huge amount of effort to get malware onto a computer. While it seems technically plausible, the steps involved (getting a compromised app onto devices, harvesting contact and location data, waiting for a subset of the infected population to speed, then delivering more malware to them via email) makes me rather dubious.