The logic seems to be that if a hacked phone was moving, the device probably wasn’t a research tool being used by a security company trying to detect malware, Trend Micro researchers said.