Friday, September 11, 2026

Pre-Installed Spyware Found on Samsung Galaxy Devices and Cannot Be Removed

Samsung users across West Asia and North Africa are raising serious privacy concerns over AppCloud.

This pre-installed bloatware application collects sensitive personal data without consent. It cannot be easily removed from Galaxy A and M series smartphones.

AppCloud, developed by ironSource, an Israeli-founded company now owned by American tech firm Unity, has been embedded into Samsung devices sold throughout the WANA region since 2022, following an expanded partnership between the two companies.

Users report that this invasive software operates in the background, without transparency, making it nearly impossible to uninstall without compromising device security or voiding warranties.

The Privacy Problem

According to independent analysis, AppCloud is deeply integrated into Samsung’s operating system, giving it extensive access to sensitive user information.

The bloatware collects biometric data, IP addresses, device fingerprints, and other personal details, yet Samsung provides no clear privacy policy for the application.

Even more troubling, users cannot opt out or turn off the software without encountering complications.

Any temporary disabling can be reversed after system updates, essentially trapping users in a cycle of unwanted data collection.

The installation occurs without explicit user consent, which raises serious questions about compliance with data protection regulations.

The General Data Protection Regulation in the European Union and relevant data protection laws across WANA countries require informed consent before collecting personal information, a requirement that appears to be violated by this forced installation.

Beyond privacy issues, the partnership raises additional concerns in certain jurisdictions. Some countries in the WANA region have restrictions on Israeli companies operating within their borders.

Yet, AppCloud’s Israeli origins are embedded in devices sold across the region. This legal gray area adds another layer of complexity to an already problematic situation.

IronSource has a documented history of questionable practices regarding user consent and data privacy, making its partnership with Samsung particularly concerning for the millions of device owners affected.

Despite granting AppCloud significant data access and control, Samsung’s terms of service fail to address the application or its developer specifically. Users receive no clear explanation for why this bloatware is necessary or what functionality it provides.

The company has offered no transparency about AppCloud’s operations, the scope of data collection, or legitimate reasons for the pre-installation.

Privacy advocates have formally requested that Samsung disclose AppCloud’s complete privacy policy, provide straightforward removal options without warranty implications, and reconsider future pre-installations of the software.

The issue highlights a broader concern about corporate responsibility regarding user privacy and the right to control what runs on personal devices.

With Samsung’s significant market share in the WANA region, the company’s response to these demands will set an important precedent for privacy protection and consumer rights in mobile technology.

Follow us on Google NewsLinkedIn, and X to Get Instant Updates and set GBH as a Preferred Source in Google.

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Hot this week

How To Access Dark Web Anonymously and know its Secretive and Mysterious Activities

What is Deep Web The deep web, invisible web, or...

How to Build and Run a Security Operations Center (SOC Guide) – 2023

Today’s Cyber security operations center (CSOC) should have everything...

Russian Hackers Bypass EDR to Deliver a Weaponized TeamViewer Component

TeamViewer's popularity and remote access capabilities make it an...

Web Server Penetration Testing Checklist – 2026

Web server pentesting is performed under three significant categories: identity,...

ATM Penetration Testing – Advanced Testing Methods to Find The Vulnerabilities

ATM Penetration testing, Hackers have found different approaches to...

Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign

A long-running pay-per-install (PPI) operation that used YouTube gaming...

VLC Media Player Flaws Let Attackers Corrupt Memory and Leak Sensitive Data

Two security vulnerabilities in VLC media player versions 3.0.0...

CISA Adds Exploited MikroTik RouterOS Flaws to Security Alert

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has...

cPanel Urges Users to Patch ConfigServer Firewall Remote Code Execution Flaw

A recently disclosed vulnerability in ConfigServer Security & Firewall...

Hackers Weaponize AI Safety Guardrails to Hide Malware From LLM-Powered Security Scanners

Threat actors are adapting malware not only for conventional...

Hackers Exploit JFrog Artifactory Flaws to Bypass Authentication and Gain Admin Access

Threat actors are actively exploiting three vulnerabilities in JFrog...

Related Articles

Recent News