The Star N9500, a low-cost Android-powered smartphone made in China, ships with more than just an 8-megapixel camera and quad-core processor, according to G Data, a German cyber security company.
The company said it discovered malicious software embedded in the device that could be used to track the user and manipulate the phone remotely.
G Data, which sells antivirus and cyber security products, said it discovered a so-called Trojan-horse malware, called Usupay.D, in the phone's Google Play app store. It said it fielded several complaints from buyers of the phone and ran tests on a newly purchased device.
Google Inc. wasn't available for comment
The company said that during testing, it found that the spyware on the smartphone sends phone identification and specification data to an unidentified server located in China.
G Data said the malware also could operate phone functions remotely, like turning on the camera, though it said it found no evidence that had happened in the phone it studied.
The company also said that sending data to a Chinese server doesn't necessarily suggest an attacker targeting the phone is based there.
G Data couldn't say how the malware ended up on the phone. Shenzhen-based manufacturer Tianxing, which makes the phone, wasn't available for comment.
G Data spokesman Thorsten Urbanski said G Data also tried unsuccessfully to contact the manufacturer.
The N9500, similar to the best-selling Samsung Galaxy S4, is a popular low-cost smartphone, offered on Amazon.com Inc. Amazon.co.uk site for between £85 ($141) for a new 5-inch version to £119.89 for a new 5.7-inch HD version. Amazon wasn't available for comment.
The malicious software is pre-installed in the phone's firmware, the software that comes embedded with the phone and operates its systems. Firmware can't simply be deleted like a regular app installed from a third-party app store.
The malware program itself was identified by Kaspersky Lab in March 2013. G Data said its analysis marks the first time Usupay.D has been discovered bundled with a mobile phone.
