Saw this mentioned on slashdot:

Lookout's blog has announced that there has been a new Trojan found that affects Android handsets. It seems that it started out by being placed inside what looked like legitimate Android apps in China, but the permissions were far outside of what would have been needed. The information was then sent to a remote server where everything could be controlled from the phone.

http://www.androidguys.com/2010/12/30/security-alert-geinimi-android-trojan/