Are you an Amazon customer? Chinese security firm Cheetah Mobile has discovered thousands of infected Android tablets sold on Amazon that come with pre-installed malware.
The company discovered the infection from its app's telemetry data. After further investigation of the data, they identified a Trojan they called Cloudsota. In all cases, customers reported purchasing the tablets from Amazon.
Not coincidentally, of course, all of the devices had very bad reviews, as many discovered apps they couldn't remove, popup ads, and hijacked browsers.
According to malware analysts at Cheetah Mobile, Cloudsota is distributed pre-installed on tablets, has root privileges and is very aggressive.
Cloudsota can install other applications (usually malware or adware), remove security applications, change the browser's homepage, alter the browser's search results, the tablet's wallpaper, display ads in the startup animation, and more.
Cheetah Mobile said that it has so far detected 17,233 infected devices and that this number could be much higher since, as mentioned above, it is able to remove security applications.
Researchers found over 30 different tablet brands that had Cloudsota pre-installed, all of which are still available online. These brands include Alldaymall Tablet, FUSION5, JEJA 7 Zoll, JYJ 7, Tagital, and Yuntab SZ Wave.
All of the above manufacturers are from China. Cheetah Mobile said it contacted all of them, but none of the companies responded to its request for comment.
