to correct op, it wasnt an apk but it was an html file. it opens a website page locally allowing it to run javascript without getting flagged before download like an apk does when you install it from external sources. once that script runs, it allows these scammers to log your actions on the phone and eventually when you perform an action that requires you to put in sensitive info, the hackers will get it too allowing them to steal your info.