IIRC SQLite was used to detect NSO Pegasus infestation in iPhones. There is a SQLite DB that tracks process execution and the malware tried to expunge...