Here the apps were "fake" random ones that users had to download from Google Play. But... the Official Carrier Apps (those signed with a key stored in the SIM

Here the apps were "fake" random ones that users had to download from Google Play. But... the Official Carrier Apps (those signed with a key stored in the SIM card [0]) are also definitely being used to push government malware. There's an official price list set by the government for "services towards authority" in the same country this eSurv is based in. [1] That list includes mandatory things carriers must do when asked (hopefully with a valid court order, but not always...), such as auto-installing backdoored apps via provisioning text messages (handled by the Carrier App); or increasing the data bundle allowance in order to avoid that a data-hungry malware could be detected by the user... Always try to avoid unnecessary apps; the Carrier App can usually be avoided by using the carriers mobile website in the phone browser, or by using USSD/SMS codes to get line info such as bundle counters, prepaid credit amount, and so on. Unfortunately sometimes a ROM change is needed; some phones in some conditions (eg. official ROM with carrier branding) will have the Official Carrier App pre-installed as system app... Sometimes in other official ROMs (even unbranded ones) there's a pre-loaded "Carrier Updater" that will auto-install the Official Carrier App for the inserted SIM card (again, as system app)... [0] https://source.android.com/devices/tech/config/uicc https://source.android.com/devices/tech/config/uicc [1] https://motherboard.vice.com/it/article/9k89j3/ecco-il-listino-prezzi-della-polizia-italiana-per-la-sorveglianza-telefonica https://motherboard.vice.com/it/article/9k89j3/ecco-il-listi...