Security researchers have discovered a malware called RottenSys, which is pre-installed on nearly 5 million popular smartphones worldwide.
The malware comes disguised as an app called “System Wi-Fi” and is pre-installed on millions of brand new smartphones from Honor, Huawei, Xiaomi, OPPO, Vivo, Samsung and GIONEE.
All of these affected devices were sold through Chinese mobile phone distributor Tian Pai, based in the city of Hangzhou, but there is no evidence that the company is involved in this scam.
According to Check Point Mobile Security Team, the team that uncovered this scam, RottenSys is an advanced malware that does not provide any secure Wi-Fi service, but instead obtains almost all sensitive permissions from an Android device to enable its malicious activities.
To cover up its activity, the fake System Wi-Fi app is initially installed without the malware and does not immediately begin malicious activity. After a while, RottenSys contacts the servers that control it to receive various malicious code packets.
RottenSys then downloads and installs these packages using the “DOWNLOAD_WITHOUT_NOTIFICATION” permission which does not require any action or permission from users.
Currently, this malware is promoting an adware component on all infected devices that displays pop-up windows, aggressive advertisements on the device's home screen. There have even been reports of full-screen advertisements, of course with the aim of generating advertising revenue.
According to Check Point researchers, the malware has earned its creators over $115,000 in the past 10 days alone. The investigation also revealed that RottenSys administrators have already begun turning millions of these infected devices into a massive botnet.
How to check and remove RottenSys malware.
To check if your device is infected with this malware, go to “Settings” and from there to “Installed applications” (Settings > App Manager), then look for the following possible malware package names:
- com.android.yellowcalendarz (daily calendar)
- com.changmi.launcher (desktop)
- com.android.services.securewifi (System WIFI)
- com.system.service.zdsgt
If any of the above applications are in your list of installed applications, simply remove them.
