I've been looking every where for information on this. Not just the app, but I've had the same thing happen to my phone since April of 2019 (at least that's when I caught on). I've gotten several new phones since then and they're all fine at first, then some how they get hacked. I'm assuming it's someone close to me.
I finally noticed after waking up one morning, when I got a developer warning/notification that said "An SD card was inserted with write permissions". Sure enough, I found an SD card in my phone that I didn't put in there. I assume it happened while I was sleeping.
Then I took it to Tmobile and they showed me my developer options had been turned on (I didn't turn it on as I'd have no reason to do so). And when I accidentally tried unlocking my network while trying to figure out what was going on, I had to call Tmobile to fix it and they needed my IMEI in order to do so. I gave it to them and they told me that there was 2 IMEI numbers registered to my phone. I have an s10+ and it's a single sim. So there should only be one IMEI registered to it. Tmobile even said it's strange and they've never seen that before, but also pointed out that my data skyrocketed to over 100GB a month around the same time this started.
A Microsoft office account keeps randomly appearing on my phone even though I constantly remove it and don't use Microsoft. When I try to disable certain apps, it tells me to deactivate admin. But there's no device admin apps on my phone.
I'm starting to think someone linked a fake IMEI to my phone and registered it in knox enrollment/enterprise as an employee phone in order to have access to and control what I'm able to do.
Have you found any other info on this yet or have you also experienced this? I'm sorry I couldn't be of more help with your question, but I hope some of the information I provided helps you get closer to figuring it all out.
Facebook
Twitter
Instagram