I saw an interesting presentation a few months back that kinda mirrors this... it was about FinSpy, which is a mobile rootkit for many major mobile platforms (android, apple ios, etc.) that could do a lot.
SMS interception, record phone conversations, ... pretty much anything the phone can do, this could do. I can't really recall now if it had botnet capabilities, but I do believe it did (seems like it would, given everything else it can do).
Stay safe guys, only install *trusted* software.
