The fact that the pages are fake directs lead on my suspicion more. I scanned the system app "VmosService" for viruses and here are the results. In conclusion, if you use VMOS, use the root to DELETE all Google and VMOS apps!

RedFinger app results:
CLEAN from Virustotal and NVISO

VmosService system app results:
https://is.gd/c8vqxt (Virustotal threat 3/59)
https://is.gd/qI09dE ("confirmed malicious")

(Toot 3/3)