While some tools are legitimate, many keyloggers are "silent killers" used for cybercrime. Does mSpy Really Work for Monitoring Facebook on Android
You download an (Android Package Kit) from a third-party website. That APK is not Facebook. It is a Remote Access Trojan (RAT) packed with a keylogger module.
If you cannot find the keylogger, back up only your photos (not apps) and perform a factory data reset. This is the only 100% guarantee.