It’s unlikely, but possible. Official app stores, such as Google Play Store and Samsung Galaxy Store, have vetting processes to catch malicious apps and viruses. While rare, every now and then malicious apps get through. And like said, some apps can do bad things without being viruses. These apps can be downloaded from app stores. Unofficial app stores, however, are a different thing. They can be practically anything. Same goes for apps downloaded from websites. Only trust official app stores to better protect your phone.