Malware which signed users up to subscription services without their permission has been found on thousands of mobiles sold in Africa.
Anti-fraud firm Upstream found the malicious code on 53,000 Tecno handsets, sold in Ethiopia, Cameroon, Egypt, Ghana and South Africa.
Manufacturer Transsion told Buzzfeed it was installed in the supply chain without its knowledge.
Upstream said it was taking advantage of the “most vulnerable”.
“The fact that the malware arrives pre-installed on handsets that are bought in their millions by typically low-income households tells you everything you need to know about what the industry is currently up against,” said Geoffrey Cleaves, head of Upstream’s Secure-D platform.
The Triada malware found by the firm on the Android smartphones installs malicious code known as xHelper which then finds subscription services and submits fraudulent requests on behalf of users, doing so invisibly and without the user’s knowledge.
If the request is successful, it consumes pre-paid airtime, the only way to pay for digital services in many developing countries.
In response Tecno Mobile said that the issue was “an old and solved mobile security issue globally” to which it issued a fix in March 2018.
It added that it is attached “great importance to consumers’ data security and product safety”.
“Every single software installed on each device runs through a series of rigorous security checks, such as our own security scan platform,” it added.