Would it be possible for an app to “mask” its true purpose?

I’m writing a novel that blends current smartphone tech with sci-fi elements and I have some questions about smartphone apps and mobile web servers. I’d really appreciate the help, as I’m not an expert in this area and struggling to find good answers.

1. Would it be possible for an app to “mask” its true purpose to get approval for the major app stores, only to change or update its functionality once already installed on people’s phones?
2. Similarly, would it be possible for an app to have a virus hidden in its code? A virus that would only be “turned on” once the app developer told it to do so?
3. Is it possible to host a website on a cell phone accessible to anyone in the world? If so, how would people access the site? Could they use an IP associated with the phone hosting the site to avoid having to create a domain/use a DNS?
4. Say the bad guys in my book wanted to keep the site online for as long as possible, so used this virus to turn everyone’s phones into mobile web servers that hosted copies of this illegal website. What are some ways they could try to avoid getting caught by the authorities?

If you read this far, thank you! And sorry for my ignorance regarding all of this—I'm trying to learn.