I'm not sure why this is a big deal at all. 38 phones. 38 phones that were bought either new, used, or refurbished (since it ranges from a Note 2 to an S7), in a 3rd world country (just based on the brands), and probably from a shady dealer. The dealer installed malware on them. Done. It's not like this is a widespread outbreak of malware, it's a company making a **** decision to cut corners on their IT and security.