Mira downloaded the APK. It was a 48MB ghost. She scanned it for malware three times. Clean. Then she wrote a small wrapper script—a shim that would trick Facebook’s servers into thinking the phone was running Android 5.0.