Some apps do actually generate random private keys and check if they have a balance. But the creators pre-load the app with a few known addresses that do contain Bitcoin, then display these as "results" to trick you into believing the app works. You'll be asked to pay a fee to "withdraw" the found Bitcoin, and then you get nothing.

You download an APK that claims to scan for "vulnerable" private keys. When you run it, it asks you to "import your wallet for verification" or "connect your wallet to begin the finding process." Once you enter your private key or recovery phrase, the app immediately sends your funds to the scammer's wallet.

Bitcoin private keys are 256-bit numbers. The total number of possible private keys is approximately 2^256, or:

115 quattuorvigintillion (that's 78 digits).

To put that in perspective:

No Android APK, desktop software, or supercomputer can "find" a private key for an arbitrary Bitcoin address. Any app claiming to do so is either:

The app displays a spinning wheel and fake "keys found" that are actually just randomly generated. After scanning for hours, it claims to have found a key with "0.0001 BTC" but demands $50 to "unlock" it. Paying does nothing.

A Bitcoin private key is a randomly generated 256-bit number. The total number of possible private keys is approximately 2^256, which is:

115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,936

To put that in perspective:

Companies like Wallet Recovery Services (founded by Dave Bitcoin) work on contingency. They have GPU clusters for brute-force and will never request an APK install.