I had this literally happen with a popular app from the Google Playstore. They sent an in-app notification and looked 100% like a routine update.