Researchers spotted covert data extraction and tracking, but the apps responsible quickly removed the script.