Proprietary ·

Star N9500 firmware shipped Uupay.D

G DATA found Star N9500 smartphones shipping with Android.Trojan.Uupay.D hidden in firmware as a fake Google Play Store app.

The Star N9500 was sold as a cheap Android smartphone resembling a premium device. G DATA bought and analyzed the phone after customer reports, then found Android.Trojan.Uupay.D already integrated into the firmware.

The malware masqueraded as Google Play Store. Because it lived in preinstalled firmware, ordinary users could not remove it. It ran in the background, deleted traces, blocked security updates, and sent personal data to a server in China.

G DATA described broad spyware capability: access to personal data, calls, online banking data, emails, SMS messages, camera and microphone control, and silent installation of additional apps. The distribution path was the device itself, sold through online retailers before the buyer ever installed software.

That makes the Star N9500 record different from a bad app-store download. The compromise was already below the user's normal control plane at first boot, hidden under the identity of a trusted Google component and tied to firmware that buyers could not easily inspect or replace.

Notes

  • Three references were repaired on 2026-09-02 after the archived copies showed them failing. The Hacker News URL was wrong rather than dead: the article exists at /2014/06/chinese-android-smartphone-comes-with.html.
  • The Guardian and Help Net Security URLs were 404 live, had no capture at any timestamp, and no search result shows either outlet covering the Star N9500 at those addresses, so they are removed rather than kept.
  • Graham Cluley and VOA are added in their place; both were fetched and cover the same G DATA finding. The G DATA post itself is retained: its URL is correct and now redirects into the vendor's current blog.

Appendix · Affected releases

Star N9500 firmware
  • G DATA named Star N9500 as the confirmed affected model and said it was sold through online retailers in Europe.

References

  1. Android smartphone shipped with spywaregdatasoftware.com
  2. Chinese Android Smartphone comes with Pre-installed Spywarethehackernews.com
  3. Chinese Star N9500 smartphone shipped with Trojan pre-installedvirusbulletin.com
  4. Chinese Android smartphone comes with malware pre-installedgrahamcluley.com
  5. Chinese Android Phone Shipped with Spywarevoanews.com

Source record: proprietary/star-n9500/meta.yaml