Why is it that bad guy seem to be more innovative in the Security Space - New technique to detect Sandbox

 malicious Android apps in the official Google Play Store are using the motion-sensors of infected devices. If the apps fail to detect any movement (which is - of course - unlikely in a sandbox environment in a research lab!), they refuse to activate their malicious payload.
If, however, there has been movement, the apps display a fake system update dialog which attempts to trick the poor user into installing a piece of banking malware called Anubis

https://www.grahamcluley.com/android-malware-motion-sensor/