Lookout Warns Travelers That Chinese Authorities Can Extract Data From Phones

Chinese authorities are using new malware that enables them to extract data from devices to which they have physical access, TechCrunch reported Wednesday (July 16), citing its interview with Lookout Staff Security Intelligence Engineer Kristina Balaam.

The malware allows them to access text messages, images, location histories, audio recordings, contacts and other data, according to the report. The text messages the malware can obtain include those from chat apps.

The report said China’s state security police have legal powers to search phones and computers, even without a warrant, so travelers’ devices could be seized and fitted with the malware at border checkpoints, for example.

“I think anybody who’s traveling in the region needs to be aware that the device that they bring into the country could very well be confiscated and anything that’s on it could be collected,” Balaam said, per the report.

The malware is called Massistant and was developed by Chinese tech giant Xiamen Meiya Pico, which was sanctioned by the U.S. government in 2021 for supplying technology to the Chinese government, according to the report.

Lookout has found only an Android version of the malware, but it has seen Xiamen Meiya Pico promotions that suggest there is an iOS version for extracting data from Apple devices as well, per the report.

The PYMNTS Intelligence and PayPal collaboration “Consumer Interest in an Everyday App” found that even though more consumers than ever now rely on mobile apps to manage their daily chores, 64% of both U.S. and Australian consumers “felt uneasy about an everyday app’s ability to safeguard sensitive personal and financial information.”

It was reported in February that Apple has clashed with several governments over their demands that the company give them a way to access global user data stored in its cloud services.

At the time, Apple was reportedly facing an order from British authorities to provide such access. In 2015, the U.S. government used a third party to access the user data of the perpetrator of a high-profile shooting after Apple refused to allow access.