# More Pre-Installed Malware Has Been Found In Budget US Smartphones 

**URL:** <https://onehack.st/t/more-pre-installed-malware-has-been-found-in-budget-us-smartphones/95799>\
**Category:** News & Articles\
**Tags:** hacking, phone\
**Created:** [July 10, 2020, 11:47am UTC](https://onehack.st/t/more-pre-installed-malware-has-been-found-in-budget-us-smartphones/95799 "2020-07-10T11:47:35Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![NoBody](https://onehack.st/user_avatar/onehack.st/nobody/32/163880_2.png) [@NoBody](https://onehack.st/u/NoBody)\
**Post date:** [July 10, 2020, 11:47am UTC](https://onehack.st/t/more-pre-installed-malware-has-been-found-in-budget-us-smartphones/95799/1 "2020-07-10T11:47:35Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/0/8/0855f5f20df674f810e3a7564b773831bf7492bc.jpeg)

Pre-installed malware has been [discovered on another budget handset connected to Assurance Wireless by Virgin Mobile](https://www.zdnet.com/article/more-pre-installed-malware-has-been-found-in-budget-us-smartphones/). ZDNet reports:

_Back in January, cybersecurity researchers from Malwarebytes [discovered unremovable malware](https://news.slashdot.org/story/20/01/09/1752211/unremovable-malware-found-preinstalled-on-low-end-smartphone-sold-in-the-us) bundled with the Android operating systems on the Unimax (UMX) U686CL, a low-end handset sold by Assurance Wireless as part of the [Lifeline Assistance program](https://www.fcc.gov/general/lifeline-program-low-income-consumers), a 1985 U.S. initiative which subsidizes telephone services for low-income families. There was no way to remove a pair of apps on the handsets which would install other software on the devices without the user’s knowledge._

 

_Now, Malwarebytes has [uncovered](https://blog.malwarebytes.com/android/2020/07/we-found-yet-another-phone-with-pre-installed-malware-via-the-lifeline-assistance-program/) another budget handset with similar security issues. The smartphone in question is the ANS (American Network Solutions) UL40, running Android OS 7.1.1. […] In the same way as the UMX U686CL, two apps – a settings app and wireless update app – are compromised. However, these apps are not infected with the same malware variants; instead, Collier says the “infections are similar but have their own unique infection characteristics.” The Settings app is detected as Downloader Wotby, a Trojan that is able to download apps externally. The researchers did not find any evidence of malicious apps in a third-party store linked to the software but noted this doesn’t mean that malicious apps could not be added or find their way into the store at a later date. The WirelessUpdate app is considered a Potentially Unwanted Program (PUP) that is also able to automatically install apps without user permission or knowledge. While the app does function as an over-the-air updater for security fixes and as an updater to the operating system itself, the software also installs four variants of HiddenAds, a Trojan family found on Android handsets._ Thankfully, Malwarebytes has instructions on [how to stop HiddenAds infections](https://blog.malwarebytes.com/detections/android-trojan-hiddenads/).