I've seen an Android 2 Gingerbread PoC game app in which you were supposed to tap moving objects. The trick was that after tapping a few objects, the app would call the settings page where the "unknown sources" is. The next object to be tapped was right where the check box appeared so it would trick the user into tapping it. Then the game would focus on itself so the trick was barely noticeable.
Android 4 still allows apps to pop settings pages (the Maps app pops up the GPS settings screen) but it added a confirmation message for when you allow unknown sources. This confirmation message would still be vulnerable to the same trick but it would be more noticeable.
The name of the APK above suggests a social engineering trick to get the user to install the APK on a phone that hopefully has "Allow installation of non-Market apps" (aka "Unknown sources") setting checked. But a legitimate Play store app could trick a user into allowing unknown sources and then it could direct to a site similar to the one mentioned in this question.
This kind of blended attacks are real but don't cause large scale compromises worthy of media attention .... until they steal 36 million euros.