To work like the original prank (spawning windows or staying on top of other apps), the APK will ask for or "Accessibility Services" permissions. Granting these to an unverified APK is one of the most dangerous things you can do on Android, as it gives the app total control over your screen. Is There a Safe Way to Experience It?
There is a certain irony in downloading something labeled a virus. Hackers often rely on social engineering