The article about the 18 apps says that the ads were running in the background.

A Forbes article on the same incident also reports that data was exfiltrated from the infected devices:

> the trojan [...] sent data from the infected device to an external command and control server.