MalwareBytes: an Android phone offered free by Assurance Wireless as part of the US Lifeline Assistance program comes pre-installed with Chinese malware
With help from John Hendel and Eric Geller Paul Wagenseil / Tom's Guide : ‘Obamaphones’ come preloaded with malware Catalin Cimpanu / ZDNet : Unremovable malware found preinstalled on low-end smartphone sold in the US Dan Goodin / Ars Technica : US Government-funded Android phones come preinstalled with unremovable malware Bogdan Popa / Softpedia News : Cheap Android Phones Funded by US Government Infected with Unremovable Malware Alyse Stanley / Gizmodo : Federal Program Offers Free Phones For the Poor, So Long as You're OK With Chinese Malware Colm Gorey / Silicon Republic : Phone pre-installed with ‘Chinese malware’ offered for free by US government Cohen Coberly / TechSpot : US government-funded smartphones are shipping with pre-installed malware Ewdison Then / SlashGear : US-funded Android phone comes with free malware you can't remove Mike Dano / Light Reading : Sprint Sold Phone With Chinese Malware, Cybersecurity Firm Claims Tom Maxwell / Input : U.S. government-funded smartphones are infested with malware Muhammad Jarir Kanji / Android Central : The U.S. government is handing out malware-infested phones to the poor Anil Ganti / Wccftech : Low-Cost Chinese Phone Subsidized by the US Government Found to be Running Unremovable Malware Nathaniel Mott / Tom's Hardware : MalwareBytes Identifies ‘Unremovable’ Malware on US Government-Funded Phones BBC : US-government issued phones run ‘Chinese malware’ Tweets: Thomas Brewster / @iblametom : New - This is pretty bad. The FCC funds a program offering free Android phones to low-income people. The Android phones come pre-loaded with Chinese malware... that you can't remove. Wtf. https://www.forbes.com/... @hackermaderas : I've been stating this since late 2018: US government-funded Assurance Wireless phones by Virgin Mobile that are/were given to low income Americans come pre-installed with unremovable malware. https://blog.malwarebytes.com/ ... https://twitter.com/... https://twitter.com/... https://twitter.com/... @malwarebytes : U.S. government-funded #Android phones come with preinstalled Chinese #malware, which effectively opens up a #backdoor onto the device and endangers your private data. Via @Forbes https://www.forbes.com/... Matt Hodges / @hodgesmr : This is a great example of why when people tell you that “it is 100% possible to have fraud-proof voting on our mobile phones today” because of blockchain, they are dangerously wrong. https://twitter.com/... Thomas Brewster / @iblametom : Update: Senator @RonWyden is to ask the FCC to ensure devices shipped to low-income families aren't full of privacy and security threats. https://twitter.com/... @malwarebytes : A US-funded government assistance program is selling budget-friendly #mobile phones that come pre-installed with unremovable malicious apps. Malwarebytes Labs investigates the #malware's origins. https://blog.malwarebytes.com/ ... Eva / @evacide : The US government funds free Android phones for the poor. And of course the real price is their privacy and security. https://www.forbes.com/... Jessica Rosenworcel / @jrosenworcel : The @FCC funds a program to help low-income folks get access to wireless service. This makes sense. But it does not makes sense to have them pay for it by accepting insecure foreign malware. We need to get to the bottom of what is going on here—fast. https://www.forbes.com/... Thomas Brewster / @iblametom : PSA - Privacy is for rich people. https://twitter.com/...
Context & Ripple Effects
Malwarebytes' finding that free Lifeline phones from Assurance Wireless shipped with unremovable Chinese malware was an early data point in what became a recurring pattern: researchers later documented malware preinstalled on low-cost Android phones and smart TVs from lesser-known brands at global scale, and Human Security in 2025 traced more than a million infected Android TV boxes, tablets, and car infotainment systems into a botnet. The 2020 report matters because the victims were the hardest to protect — low-income Americans who received the devices through a government-subsidized program and, as the coverage stresses, could not remove the infection.
First-order effects
- Lifeline recipients are carrying devices with firmware-level malware they cannot uninstall, making a federal subsidy program an unwitting distribution channel for infected hardware.
- Assurance Wireless and the Lifeline program face immediate credibility pressure over device sourcing and vetting, since the story implicates the specific phones the program hands out.
Second-order effects
- Carriers and program administrators supplying subsidized devices are pushed toward stricter vendor audits, because a single preinstall incident taints the whole low-cost device pipeline.
- The finding feeds the FCC's widening posture on Chinese hardware — the agency has already moved against foreign drone batteries and qualifying robotic devices, and is reportedly drafting 2026 import restrictions on new Chinese optical transceivers.
Third-order effects
- If the preinstall pattern holds — from this 2020 report through the 2023 brand-level findings and the 2025 botnet — low-cost Android hardware becomes a structural supply-chain security problem, not a one-off, and governments respond by naming the threat: the 2025 joint advisories on China-linked spyware families BadBazaar and Moonshine already treat legitimate-looking Android software as a national-security issue.
- Subsidized-device programs for vulnerable populations emerge as a distinct attack surface regulators must police, since recipients lack the means to detect or replace compromised hardware.
The trend: Preinstalled malware in low-cost Android hardware has recurred from 2020 through 2025, steadily pushing the FCC and allied governments toward import restrictions and public advisories on Chinese-connected devices.