A container app runs another app inside an additional software environment, which may isolate or manage the app’s files, data, and activity. On Android, container apps can be used for legitimate purposes such as separating work and personal apps, but they can also be abused to disguise or control a tampered app.
In cyber attacks, a malicious container may place a familiar service client inside an environment controlled by an attacker. This can expose sensitive data or enable surveillance on the device without compromising the service provider itself. Install apps only from trusted sources, avoid unfamiliar container apps, and investigate unexpected app packages or environments on managed devices.