What Actually Happens After a Bad Install
The common outcomes are dull rather than dramatic: heavy advertising, a package that reinstalls itself after removal, notifications pushing deposits at a linked operator, and data about your device sold onward. The severe outcomes involve accessibility access — messages read, one-time codes forwarded, and taps performed in other apps while the screen is off.
Very little of this is visible while it happens. That is why the permission list, read before the install, is worth more than any amount of vigilance afterwards.
If You Have Already Installed Something
Do not start by uninstalling. Revoke accessibility and overlay permissions first, then check for a device-admin entry, then remove the package, then change the passwords for anything you opened on that phone — from a different device. The full sequence, in order, is on the recovery page.
For what these packages claim to do in the first place, and why the claim fails before the safety question even arises, start at the home page.