Samsung has been accused of shipping budget Galaxy A and M series smartphones with pre-installed spyware that users can’t easily remove.
The software in question, AppCloud, developed by the mobile analytics firm IronSource, has been embedded in devices sold primarily in the Middle East and North Africa (MENA) region.
Security researchers and privacy advocates warn that it quietly collects sensitive user data, fueling fears of surveillance in politically volatile areas.
AppCloud tracks users’ locations, app usage patterns, and device information without seeking ongoing consent after initial setup. Even more concerning, attempts to uninstall it often fail due to its deep integration into Samsung’s One UI operating system.
Reports indicate the app reactivates automatically following software updates or factory resets, making it virtually unremovable for average users. This has sparked outrage among consumers in countries such as Egypt, Saudi Arabia, and the UAE, where affordable Galaxy models are popular entry points into Android.
The issue came to light through investigations by SMEX, a Lebanon-based digital rights group focused on MENA privacy. In a recent report, SMEX highlighted how AppCloud’s persistence could enable third-party unauthorized data harvesting, posing significant risks in regions with histories of government overreach.
“This isn’t just bloatware, it’s a surveillance enabler baked into the hardware,” said a SMEX spokesperson. The group called on Samsung to issue a global patch and disclose the full scope of data shared with ironSource.
Social media platforms have amplified the controversy, with viral posts claiming international bans on affected devices. However, official statements from Samsung and regulatory bodies like the FCC deny any such prohibitions, labeling the rumors as misinformation.
Samsung has yet to respond directly to SMEX’s allegations, but a company spokesperson reiterated their commitment to user privacy standards.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
This week's roundup covers a record-setting Microsoft Patch Tuesday, an actively exploited Cisco firewall zero-day,…
Microsoft is moving closer to a unified Copilot experience by merging key elements of its…
AWS Certificate Manager (ACM) has announced plans to permanently discontinue email-based domain control validation (DCV)…
A sprawling Azure data exfiltration campaign is unfolding across the dark web, with a threat…
Bill Robbins, CEO of Menlo Security An AI agent broke out of the sandbox built…
Threat actors have begun actively probing and attempting to exploit a maximum-severity flaw in SAP…