Investigation reveals 25-year-old developer sold apps that bypass anti-virus software to criminals across states.