Some low-end smartphones and tablets, sold in Asian and African countries, have been found to have a pre-installed Trojan of Chinese origin that is only activated under certain conditions.
The malware has been dubbed DeathRing and appears as a ringtone app that embeds itself into the device's system folder, making it impossible to remove. The malware can run and download additional applications that are dangerous to the system.
Mobile security company Lookout says DeathRing is installed on some products supplied by third-party manufacturers from countries including Vietnam, Indonesia, India, Nigeria, Taiwan, and China. It has also been reported on devices originating from Kenya, Tanzania, and Uganda.
Its capabilities include receiving SMS and WAP content from a server it controls. This is done to extract personal information from users, which can be used for malicious activities.
The researchers say that DeathRing does not activate immediately and begins to function after five device reboots or “after fifty activations from stb mode.”.
The clone of the Samsung Galaxy S4 and Note II has been found to have the most dangerous malware on its system
