Android phones have a new kind of heartburn: an academic team has revealed a cheeky new attack called Pixnapping.