EXPOSED: Samsung phones in West Asia/North Africa (WANA) region embedded with 'unremovable' Israeli spyware

https://www.thecanary.co/skwawkbox/2025/09/22/israeli-spyware-samsung/

An Israeli tech firm has quietly embedded spyware into Samsung smartphones - and it poses a serious surveillance threat

Original article from May: https://smex.org/open-letter-to-samsung-end-forced-israeli-app-installations-in-the-wana-region/

206 points · 11 comments · view on lemmy.world

11 Comments

GreenShimada@lemmy.world · 41 pts · 276d

From another article - the app is called "Aura:

The app in question allows access to users' data, including sensitive information such as IP addresses, device fingerprints, and personal details, enabling the identification and geographical location of the phone’s owner

Mwa@thelemmy.club · 17 pts · 276d (4 replies)

If I rooted my phone can I somehow remove them(maybe with adaway and canta)??
But tbh I will never buy a Samsung again.

Edit: I don't think you need root to remove it.

WreckingBANG@programming.dev · 18 pts · 276d (1 reply)

I am not a professional, but i would say you can probably remove the App, BUT with just removing the App it might still be somewhere on the phone on a deeper level that you cannot really see right away and is hard to trace.

IceFoxX@lemmy.world · 4 pts · 276d

[ removed ]

unexposedhazard@discuss.tchncs.de · 2 pts · 276d (1 reply)

Always root if in doubt. Even that is not enough sometimes, but it usually is.

Mwa@thelemmy.club · 2 pts · 276d

I unlocked my bootloader and rooted anyways after that no longer can unlock bootloader thingy.

adhd_traco@piefed.social · 17 pts · 276d (1 reply)

The app’s privacy settings claim that users can disable this data collection by turning off “AppCloud” in the app list. But, according to SMEX, deletion requires the user to submit a form that does not exist, making it impossible to fully remove, at least without advanced technical expertise.

Hm, I just uninstall AppCloud no problem in a non-rooted, stock android in and from the region.
It also showed the URI or whatever of com.something.aura.

However, can't find any Aura app.

Looks like Aura app gets installed by AppCloud. I'm a bit frustrated I can't find a list of apps known to be installed by AppCloud, or that include this *.aura.* URI. I mean this should be relevant for a shit ton of people and could be easily crowdsourced.

adhd_traco@piefed.social · 2 pts · 276d

Some more information:

I looked at four different Samsung phones today (physically in the region). 2x phones bought in Europe. 2x phones bought in the region.

All non-rooted, stock android.

None of the phones had Aura installed. Two of them had AppCloud installed (one EU phone, one phone from the region) and it couldn't be disabled as easily as the other phone. (I haven't tried ADB, etc. yet, just the standard uninstallation procedure).

FundMECFS@anarchist.nexus · 6 pts · 276d

I’m grateful the canary exists and covers a lot of underreported stuff that needs a “canary” to ring the alarm bell.

I do think they could do with sensationalising and exaggerating a little less in their titles though.

Nasan@sopuli.xyz · 3 pts · 276d

They should call it WANACry when it gets used for extortion.

throws_lemy@lemmy.nz · 3 pts · 276d

I remember some time ago this topic was discussed in a Telegram group about privacy. Some users began accusing OP of being anti-Semitic.

IceFoxX@lemmy.world · -1 pts · 276d (2 replies)

[ removed ]

unexposedhazard@discuss.tchncs.de · 6 pts · 276d (1 reply)

This info actually dropped months ago but it didnt get much mainstream coverage i think.

IceFoxX@lemmy.world · 2 pts · 276d

[ removed ]