Any app can have malware/spyware. This is why you have to be careful with permissions.
Some apps want to access everything on your phone for no particular reason. I hate that.
One more reason not to store sensitive data on your phone...such as credit cards.