It's everything from a mix of cryptominers being deployed quietly (since of course anyone installing these will have a low end or better GPU), app install fraud

It's everything from a mix of cryptominers being deployed quietly (since of course anyone installing these will have a low end or better GPU), app install fraud, review fraud, Play token theft, spyware-tier telemetry. Even on the ones that don't install anything bad at all, they tend to auto-install the lowest common denominator apps via advertisements or paid placement that then have their own absurdist SDKs or whatever for data collection and mining. Pretty much any of the closed source emulators that can feasibly run games (i.e., be horribly abused en masse for botting games) are festering piles of crap. Another super common thing in those low tier trash apps is using your computer as a proxy ala Hola. Pay-per-install for using you to run stolen card traffic.