Cheap Samsung Clone Packs Malware, Security Experts Warn

A Trojan Hides Behind a Familiar Shell

A phone that mimics the Samsung Galaxy S4 arrived on Amazon and eBay with a virus that pretends to be the Google Play Store. The device, marketed as the Star N9500, is built in China and sold by resellers in Belfast and Hong Kong for under £120. G Data’s analysis confirmed that the pre‑installed Trojan, named Uupay.D, cannot be removed by the user.

Christian Geschkat, product manager at G Data, wrote that the spyware gives criminals “full access to the smartphone.” The malware silently harvests contacts, location, call recordings, and payment credentials, then pushes the data to an anonymous server in China. It can also install additional apps without consent, turning the phone into a backdoor for further attacks.

How the Spyware Operates

Uupay.D disguises itself as the official Google Play Store icon, appearing in the running processes as a legitimate system app. When a user taps the fake store, the Trojan silently downloads payloads and exfiltrates data. The code can track the device’s GPS, intercept calls, and send premium‑rate texts that charge the owner’s carrier account.

The trojan’s capabilities extend to bypassing two‑factor authentication and injecting malicious code into banking apps. Because the malware is baked into the firmware, a factory reset does not eradicate it. The only practical remedy is to flash a clean ROM, a step most average buyers will never take.

The Lure of Low‑Cost Clones

The Star N9500’s price undercuts genuine Samsung models by two‑to‑three times. Reviewers on Amazon praised the phone’s appearance, with one buyer exclaiming, “Wow, this phone is amazing, especially when I look at those of my mates who have spent £500 plus for the same thing with the word Samsung on it!” The device ships with a second battery, car charger, and protective cover, further inflating perceived value.

Cheap hardware often comes with compromised build quality. Users reported screens cracking after a few months and batteries failing prematurely. Those shortcomings are intentional; a lower‑priced device attracts buyers who prioritize cost over durability, while the hidden malware generates a steady stream of stolen data for the operators.

Official Android Updates vs Bloatware

While the cloned phone runs a tampered Android build, flagship Samsung and Google devices follow distinct update paths. Samsung’s One UI recently removed the all‑apps button from the home screen, but users can restore it with a single toggle in settings. The change illustrates Samsung’s willingness to iterate UI elements without breaking core functionality.

Google Pixel phones, by contrast, receive faster OS updates and ship with minimal pre‑installed software. Faster updates reduce the window for known vulnerabilities to be exploited, a benefit the Star N9500 lacks entirely. The Pixel’s lean software stack also eliminates the need for users to sift through unnecessary apps that can become attack vectors.

Both manufacturers benefit from brand trust. When a buyer chooses a recognized name, they receive regular security patches, vetted app stores, and accountability from a corporate support structure. The cloned device offers none of those safeguards.

What to Watch

Security researchers advise monitoring the resale market for devices that mimic popular models but lack official branding. Watch for new reports of pre‑installed malware on low‑cost Android phones, especially those sold on global marketplaces. Regulators may soon require stricter provenance verification for smartphones sold online. Until then, buyers should verify the seller’s reputation, demand a legitimate warranty, and avoid devices priced far below market norms.