On my year-old BLU Advance 5.0 HD phone (running Android 6.0), I recently had a few suspicious incidents where the Audio Profile seemed to have changed from Meeting to Normal on its own, and once where the phone started playing music by itself (and not anything that's on the phone). At this point, I noticed three strange entries in the apps list: "androidrbx", "mfn" and "swak news" (all lowercase), all with generic icons. I have never installed anything of the sort, and the swak news one had all kinds of app permissions, which I had not granted. I deleted all three, but they were back the next day. Repeated this for a few days then figured I had malware and did a factory restore.
On the fresh install, the only additional (Play store) apps I added were Safari Queue and Duolingo, which I hoped were fairly trustworthy. No reappearance of the above trio until today, after an update of 6 apps — 5 being Google system apps (Calculator, Keep, Android Messages, Gboard and YouTube), and the last being Duolingo. Now they are back. I foolishly did all the updates at once, so I can't pinpoint the culprit (although Duolingo obviously seems most likely, unless one of the Google apps somehow got corrupted).
So now I'm trying to gather some intel from those who have more experience with the platform before I continue on the tedious process of trying to isolate the offending app or update. (If there are better forums, please point me there.) My main question is whether this is known malware, or at least has the hallmarks of such? I have searched and found no references to any of these names (except for a seemingly legit but different Swak News app), which surprised me, but perhaps the names are randomly generated. If these are legitimate "helper" apps or something, I would like to know to which app they belong, but they seem awfully suspicious to be such.