Researcher uncovers Android SMS phishing vulnerability