Malware Spotted on Government-Subsidized Android Phone

The chances of picking up malware on a mainstream Android phone with default settings are extremely low, but there are uncountable Android devices in the world. Not all those phones are entirely trustworthy, either. Some little-known phones have shown up with pre-installed malware thanks to unscrupulous suppliers or manufacturers. One such device has appeared in the US, and it’s being promoted as part of a government program. Oops.

The smartphone in question is the Unimax (UMX) U686CL, which you’ve most likely never come across. It runs Android 8.1 Go Edition with 1GB of RAM, 8GB of storage, and a removable 2,000mAh battery. It’s an extremely inexpensive phone offered on Virgin Mobile’s Assurance Wireless program. That’s part of the US government’s Lifeline Assistance Program, which is aimed at helping low-income families afford mobile service. Qualifying customers can get the phone for as little as $35, but they’re also getting some potentially nasty malware.

According to Malwarebytes, the Unimax U686CL comes with our old friend Adups pre-installed. You might remember Adups from the Amazon-exclusive Blu R1 HD, a phone that made waves for its ultra-low $50 price tag. Adups is a firmware OTA update service, but it also has extensive access to the device. The company feigned innocence when called out for the Blu phone, but here it is with more sketchy behavior on the U686CL.

Adups has the ability to install applications on the phone remotely with no user interaction. That alone makes it dangerous, though not explicitly malware. However, it appears someone is using Adups to push specific malware applications to the phone. The worst part is you can’t uninstall Adups because it’s a system app.

Malwarebytes has confirmed that, if left to its own devices, Adups will install a piece of malware called HiddenAds (Trojan.HiddenAds.WRACT). As the name implies, it exists to harass users with pop-up ads that earn money for the operators. Users can uninstall this app if they’ve savvy enough — Malwarebytes has instructions. However, there’s nothing to stop it from reappearing because the Adups software remains active.

Unfortunately, Assurance Wireless has issued a completely tone-deaf response. It says it is in communication with Unimax to understand the root cause of the issue. However, it does not believe the applications in question qualify as malware. Anyone using this device should probably start looking for an alternative.

Continue reading

Malware Masquerading as Android 2FA App Infected 10,000 Phones Before Removal

Known simply as 2FA Authenticator, the app picked up more than 10,000 installs until security researchers identified it as a vehicle for trojan-dropper malware.

Clever Malware Masquerades as Windows 11 Installer

A Russian website disguised as an official Microsoft page is distributing an "upgrade installer" that won't get you Windows 11. What it will get you is a bunch of malware.

Researchers Devise Malware That Runs When an iPhone is Powered Off

The iPhone's low-power mode allows users to access Express cards and locate lost devices even when the phone is turned off—but it also presents a concerning security vulnerability.

Google Warns of Sophisticated Malware Distributed With The Help of ISPs

According to Google's Threat Analysis Group (TAG), this spyware was developed by an Italian company called RCS Labs. The firm claims to be on the right side of the law, but that doesn't change the fact its software is being used to breach user privacy.