A key icon in the upper Status/Notification bar usually indicates a VPN service is actively enabled. Could be a third-party VPN service you set up an account with, or it could be a local-only VPN service running internally (only within your phone itself as an Android service). The former is from a VPN app you installed, the latter could be from an ad-blocker or firewall app you installed (as both use a local-only VPN service to send data through). But in either case, if there was actually a real 'hidden app' you wouldn't be seeing any kind of notification about it -- in TV shows and movies there's some kind of simplistic give-away. But here in the real world, a good exploit doesn't reveal itself with some kind of silly icon that notifies you there's a 'hidden app'.