Consumer mobile medical, health, and fitness apps, collectively known as mobile health or mHealth apps, monitor user activities such as steps, locations, and email. It seamlessly aggregates sensitive information to facilitate a wide range of functions, such as the management of health conditions and symptom checking. Although mHealth apps provide real-time health monitoring and easier access to healthcare resources, they may also pose serious risks to user safety. While the research community is primarily well aware of the user’s exposure to several types of malware, there has not been a large-scale in-depth analysis of suspicious mHealth apps using a consistent methodology. This study conducts a large-scale security and privacy analysis of 381 suspicious free mHealth apps (chosen from a corpus of 15,893 apps) available on “Google Play”. We built a customized toolset to perform a comprehensive analysis of these apps. We explore the range of mechanisms used by mHealth apps to monitor users’ activities, such as photos, text messages, and live microphone access, mainly through the injection of suspicious third-party libraries. In addition, we uncover the use of obfuscation methods employed by suspicious mHealth apps to hide their malicious codes. As mHealth apps are used by a large number of customers worldwide, we argue that patients, clinicians, technology developers, and policy-makers alike should be conscious of the hidden risks involved and weigh them carefully against the benefits.