Yeh, it sounds like you got a few problems there.
But if the phone has been rooted and compromised by undesirable third-parties. Definitely replace it with a new phone that isn't rooted, and do NOT let it out of your sight. and do NOT let any other person plug your phone into their "Kali Linux laptop" or whatever.
Also suggest you make new accounts for it as well, e.g. Google etc. Use good strong passwords, and enable two-factor authentications.