I have installed several mod apps of Netflix, amazon prime, games apk from google in android v10. Can spyware be installed through these apk. these apps have not taken much permissions from me they only take permission of storage. I have also shifted to android 11 and and also resetted my phone twice. Do any kind of spyware may exist in my phone?
Please do not install mod apps from 3rd party stores if you value your privacy.
This is how your sensitive/private info ends up on the internet.
An application does not need to have root privileges or accessibility permissions to cause harm. No need to trick you to install another app either. Storage and internet permissions are enough to steal your photos for an app. In 2014 WhatsApp was storing encrypted backups in the external storage. Someone found that all backups were actually being encrypted with the same key. This meant that any app with storage and internet permissions could steal your chat history. A vulnerability like this can be discovered and made public tomorrow, will you trust these mod apps if that happens.
When Pokemon Go was first released it was not available in my region. People were downloading APK files from random web pages. PokeGo used to request a lot of permissions. Storage, location, bluetooth, camera, internet.. Just out of curiosity, I decompiled the app to see if I could add backdoor. It took me a few hours to repack the application with a working PoC malware. I am just a hobbyist, but a determined attacker can own your phone with these permissions.
3rd party stores are free market. They don't have checks for malicious apps and known malware. Google is using advanced detection engines to scan apps before they are published on the Play Store and yet every once in a while a malicious app finds its way in to the Play Store. You can only imagine the number of malicious apps in these markets.
Some people create these mods for fun, not all of them are bad. However you just cannot know the motivations of the developer. There is a big risk and it is not worth taking.
Generally, apps on Android are very limited in terms of what they can do to other applications and the system. In order for other apps to be installed by your app, you would have to specifically grant the app permission to do so (in Android 11), and you would see prompts about all that anyway. So unless you blindly clicked on prompts and changed settings, nothing else was probably installed.
As pointed out by @yeah_well, it is much more likely that the app itself is spyware. But if you are comfortable with the level of permissions you have granted to it and accept the risk of using it, then there is probably not much to worry about.