That sounds like a virus. Two solutions I can think of:
1. Wait 72 hours. Back the device up. Reflash the stock ROM.
2. Reflash the stock ROM now and lose all the customer's data.
Once you get it fixed, install a good antivirus app and Malwarebytes, to prevent it from happening again.