Yes. An individual hacker may do this via a femtocell tower. These are heavily demonstrated at security conferences. These devices can trick your device into installing rouge malware.
Additionally, on a larger scale, rougerogue cell phone towers have been discovered and could potentially have the same capabilities.
In both cases the devices trick your phone into thinking that it is connecting to it's trusted carrier network. From here the rougerogue devices can intercept and inject data at will.