According to a US-based security firm Snoopwall, the phone location, contacts, pictures, text messages and even banking data are accessed by the flashlight apps.
The data is transmitted to market research companies and advertisers to track users, experts said.
If an app is free to use, its business model could involve selling customer data. Some apps could also be "developed by professional cyber criminals, enemy nation states for spying or by hackers for malicious reasons", they warned.
The security firm analysed the top 10 Andriod flashlight apps and found that most contain malware.
The pre-installed flashlight on apple phones was the only one which appeared to be safe, media reports said.