Xiaomi phones themselves are malware. My EU Redmi 8 was running tcpdump in the background 24/7, capturing the first 50 bytes of every packet and sending the log

Xiaomi phones themselves are malware. My EU Redmi 8 was running tcpdump in the background 24/7, capturing the first 50 bytes of every packet and sending the logs to some chinese server twice per day. One would say 50 bytes is not much and most of the traffic is encrypted (HTTPS, etc...) but the IP addresses are still in there, the DNS requests and replies are not encrypted, and having the first 50 bytes of IP packets might be enough to capture an unencrypted IMAP, SMTP or POP3 login. It's the part of the "recover lost/stolen phone" thing, but it's an overkill for that purpose. It's not documented what they are doing with the data, and this clearly violates the GDPR. Btw. never had this feature enabled. Flashed a custom ROM the next day after my discovery.