A number of Chinese-built smartphones are displaying a strange warning claiming that the Google Android app is malicious and should be immediately deleted.
Reports have claimed some Huawei, Honor, and Vivo smartphones and tablets are all displaying a “Security threat” alert, detecting the Google app as “TrojanSMS-PA”.
The details for the warning elaborate that the app is secretly sending SMS messages and could cause material damage to the user: “This app was detected sending SMS privately, enticing users to pay with adult content, downloading/installing apps privately, or stealing private information, which may cause property damage and privacy leakage,” the warning reads. “We recommend uninstalling it immediately.”
Huawei Optimizer to blame
To further complicate things, the warnings were being displayed on devices built before the China ban, so the app came pre-loaded on the phones and tablets, and wasn’t sideloaded.
In a statement given to BleepingComputer, Google said the warning was not triggered by its Play Protect feature and that the users should take it up with whoever built the devices (meaning Huawei, Vivo, and others).
“This security notification was not triggered by Google Play Protect and appears to be from a device that is not Play Protect certified and does not have access to officially download Google’s core apps from Play. We recommend contacting the device manufacturer for further information,” said the company’s spokesperson.
“Google Play is the only app store where you can officially download Google’s core apps for Android. All Google apps go through the same rigorous testing as all other apps on Google Play. These tests are designed to ensure that apps are safe, secure, and meet Google’s quality standards.”
Further analysis has shown that the warning was being issued by “Huawei Optimizer”, an app native to Huawei phones. It is yet unclear why other devices are showing the same warning. The Chinese manufacturers are yet to comment on the news. Right now, the general consensus is that the warning is a false positive, and unless users were sideloading the Google app from unverified sources, they could safely ignore it.
