I suspected that additional information might be included in the intent used to launch the app. Through debugging, I discovered that a bundle named activity_options is passed as this additional information.

While investigating the values in this bundle, I found that the key android:activity.packageName contains the value com.samsung.knox.securefolder.

// Activity
val packageName = intent.getBundleExtra("activity_options")
  ?.getString("android:activity.packageName", "empty")
  ?: "empty"

android:activity.packageName is defined in the ActivityOptions.java file under the name KEY_PACKAGE_NAME. As indicated in the description, the value for this key represents the package that created these options, which allows us to understand that the app was launched from Secure Folder.

Default	Secure Folder

This is a fact discovered through reverse engineering, and it may not function correctly following future updates to `Secure Folder.