Malware disguised as popular crypto apps could have been advertised to over 10 million users online, says cybersecurity firm Check Point.