Cool Reaper Revealed: A Backdoor in Coolpad Android Devices
Summary: Unit 42 found that the majority of stock ROMs used by Coolpad phones sold in China contained a backdoor it named CoolReaper, which Coolpad installed and operated itself. Coolpad also modified the Android OS in many of its ROMs specifically to hide CoolReaper from users and from antivirus programs, and users in China reported unwanted app installs and push-notification ads from the backdoor that Coolpad ignored or deleted.
Why it matters: CoolReaper is the first malware Unit 42 has seen built and operated by an Android manufacturer, and the OS-level changes made to conceal it mean the vendor-supplied ROM on a phone can defeat the antivirus you rely on to catch it.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026