A new phone is supposed to be a clean slate. But alarmingly, that's not always the case.
Security company G Data has identified more than 20 mobile phones that have malware installed despite being marketed as new, according to a research report. And it doesn't appear the infection is occurring during manufacturing.
"Somebody is unlocking the phone and putting the malware on there and relocking the phone," said Andy Hayter, security evangelist for G Data.
Many of the suspect phones are sold in Asia and Europe through third parties or middleman and aren't coming directly from the manufacturers, Hayter said.
The malware is embedded in a legitimate app, such as Facebook, which is sometimes preinstalled on phones, Hayter said. It can read and send text messages, install other apps, collect and change call data, grab location information, record phone calls or send premium SMSes, according to G Data's report.
It's impossible for consumers to remove since it resides inside the phone's firmware.
"You can't take it off there unless you unlock the phone," Hayter said.
G Data was alerted to the problem after receiving support calls from users who said a file had been quarantined but that it couldn't be removed.
The problem has been around for a while. In June 2014, G Data said it found malware in the firmware of a relatively inexpensive Android device made by the Chinese manufacturer Star.
The company's analysts bought Star's N9500 and found malware that purported to be an app for Google's Play Store. The malware, they found, could not be deleted.
In early 2014, Marble Security found malware embedded within Netflix's app that had been preinstalled on six mobile devices.
That malware grabbed credit card information and passwords and sent it to a server in Russia.