10 ms·
Motorola phones have started hijacking the Amazon app to insert affiliate codes
- fransje26 5mo agoThis bodes well for the up-coming GrapheneOS cooperation.. Nothing screams "secure" better than app hijacking and url injections.
- gsky 5mo agoChinese brands always pull this stuff
- 28304283409234 5mo ago[flagged]
- userbinator 5mo agoAround 10-15 years ago you could get a completely stock Android from China with basically zero branding, fully unlocked and easily rootable, removable battery, expandable storage, dual DIMs, etc. at a great price. I have a few. Unfortunately many of those small honest OEMs appear to have disappeared, and the bigger ones left have turned scummy.
- greatgib 5mo agoEspecially Xiaomi did a huge ugly U-turn like this. Use to be the best hardware for low price with the selling point of no-crap fully customable phones. And then, once they become dominant enough starting to play it like the others but stuffing as many unremovable crap as possible.
- gib444 5mo agoI was possibly thinking of getting a Motorola with G.ràphenéOS when released. Yeah, not now.
- Uzazo 5mo agoThe described behavior would not happen when you use a custom OS. I understand not wanting to give Motorola any money because of this, though.
- Cider9986 5mo agoTrue. Google does much worse things overall, but they aren't as surface-level scammy as this.
- deleted 5mo ago[deleted]
- gib444 5mo agoThe tail never wags the dog. Initially the project won't change, but it likely will over time.
- microtonal 5mo agoBut AFAIK it doesn't work like that. Motorola makes a phone that has an unlockable bootloader, provides firmware bundles, etc., but the OS images will be made by the GrapheneOS team and they would never do anything like that. (I think the misunderstanding is that Motorola would make the GrapheneOS builds.)
- gib444 5mo agoI'm misunderstanding nothing You're probably just not willing to believe that a 'partnership' with a massive company will change things, like I do. I am disagreeing, not misunderstanding. There's a difference
- microtonal 5mo agoHave you ever observed the GrapheneOS team? I have rarely seen any team more principled than them, outside maybe RMS. Time will tell, but my bet is on the GrapheneOS team doing the right thing, they have always done so in the past.
- sourcegrift 5mo agoIf an anti-worker company is getting fleeced, nothing wrong with that. I hope motorola collaborates with Pine and brings linux to phones. In the age of LLM apps are obviously not a problem. (Hopefully windows Phone 7, not 8 also comes back)
- WolfeReader 5mo agoI agree with your overall opinion, but not sure why you had to bring LLMs into a topic that has nothing to do with them.
- SubiculumCode 5mo agoI would agree, but I just looked on my phone and there was a Moto AI services app I don't remember being there before
- ta8903 5mo agoI think they mean you don't need to worry about a tiny app ecosystem these days because LLMs make it easy to create your own.
- dotcoma 5mo agoHow low can you go?
- kayson 5mo ago> In further digging, we noticed that the URL the phone opens up is “kira-abboud.com,” a website that references fashion influencer “@kirasfashionfinds.” Notably, this exact URL isn’t listed anywhere on Abboud’s social media, and the affiliate codes don’t match up either. The redirect coming from Motorola phones is using Amazona affiliate code “sramz-kff-008-20” which is completely different from any of the codes we saw from links shared by Abboud’s accounts and linked websites. Something funny is up; this doesn't seem deliberate.
- londons_explore 5mo agoMy guess is a rogue employee who hopes they can get away with this stuff for years till caught... That employees cousin probably does social media for Abboud...
- GuestFAUniverse 5mo agoNo matter how you turn it, that doesn't build trust in the Motorola brand, if a single employee can push that (hypothetical) code.
- 0xEF 5mo agoI agree, but in fairness, I don't know of any brand, tech or otherwise, that can completely wall itself off against insider threats. No matter how vigilant you are, someone who knows exactly how you move will find a way around you.
- microtonal 5mo agoI can understand it's hard to defend against plausibly deniable errors that create backdoors, etc. But this would show a complete lack of code review, no?
- mschuster91 5mo ago> But this would show a complete lack of code review, no? You'd be surprised how many websites use Google Tag Manager to allow their marketing department to roll out trackers and other JS snippet directly into the site's root context. GTM et al's sole reason of existence is to provide marketing people with a way to bypass corporate IT. And I definitely would not rule out something like this being the cause in the end.
- blitzo 5mo agoIsn't this cookie stuffing? Same modus operandi using by Geo-something widget back in 2000s with hidden ebay affiliate links that got caught by FBI. Someone should go in jail for this.
- xzxz 5mo agoI used to choose Motorola devices for a long time but since 2 years when I bought Edge 30 Fusion I started to notice they automatically (without my knowledge) add 3 stupid apps or games about two times a month :/ There is no way to stop it. My kids phones are stuffed with this sh*t.
- microtonal 5mo agoOn some phones this is done by something like AppCloud, which you can usually uninstall from the user partition using ADB/Universal Android Debloater.
- GuestFAUniverse 5mo agoOr: buy another brand and not jump hoops.
- microtonal 5mo agoDefinitely, it's more that is worth trying for people who have a phone already. E.g. on Samsung, you can remove most of the bloatware.
- catlikesshrimp 5mo agoA chinese one? My xiaomi required debloating, which left me without the "apps" menu in settings. I am not happy about having to do that. Side note: I have to use either intents or adb to administrate the apps. All the "best phones" for most of us are bloated tracking devices.
- kotaKat 5mo agoMotorola put the malware apps into the “nondisable” list. You can’t remove them even with ADB PM commands. I was fucking mad that my RAZR couldn't be fully debloated. See also: various firmware builds for Moto phones like https://dumps.tadiphone.dev/dumps/motorola/aito/-/tree/user-15-V2UC35.55-34-1-76915e-release-keys/product/etc/nondisable?ref_type=heads https://dumps.tadiphone.dev/dumps/motorola/aito/-/tree/user-...
- 5mo ago
- dingensundso 5mo agoCalling this "hijacking the Amazon app" is hyperbolic in my opinion. They replaced the shortcut in the app drawer. To me this looks like normal scummy OEM behaviour, like pre-installing spyware, "anti-" malware, adware etc. which sadly pretty much every mobile/computer manufacturer does. Replacing the OS is one of the first things I do with every laptop, PC and mobile device to get rid of (most) crap that was installed without my consent.
- userbinator 5mo agoand mobile device Very little ability to do that with most devices these days, unfortunately.
- warrantisall 5mo ago[dead]
- coretx 5mo agoThat begs the question! Did they use a Sony rootkit ? XD
- 999900000999 5mo agoTo think I was worried about buying a Xiaomi tablet while already using a Motorola. Gonna flash a rom on the Xiaomi anyway, but all oems are doing this type of stuff.
- KennyBlanken 5mo agoAll Android OEMs are "doing this type of stuff."
- petu 5mo agoNote that Xiaomi today is very hostile to bootloader unlocking -- to get unlock code you need to win in daily first come, first served "lottery" (they limit total number of unlocked devices per day). After a second or two passes you're already too late for the day.
- consp 5mo agoNo wonder there are numerous dubious sites doing it for you ... this breeds abuse.
- 999900000999 5mo agoThank you for letting me know, the plan right now is to try for about a week or 2 and then give up and return the tablet if I can't. Which is a damn shame because not too many options exist with a headphone jack and a Snapdragon processor. I'm in an environment where Bluetooth is unreliable for a good chunk of my day. The only other tablet that fits my needs is a gosh darn Surface which is like 1000$.
- VortexLain 5mo agoAnd the only way to win this lottery is by using an automated script that starts sending automated requests as soon as the new day starts at Beijing time.
- risfriend 5mo agoThis is really unethical, replacing original app shortcuts breaks trust.
- heikkilevanto 5mo agoThe comments here say that all Android phone manufacturers do stuff like this. I have never noticed that kind of things on my Fairphone. But then again, I don't have many apps and certainly not Amazon.
- microtonal 5mo agoFairphone or Pixel with GrapheneOS are currently the best bets if you actually want to own your phone.
- sandreas 5mo agoHmm, this thread and the reports of shady practices make me wonder if this will affect the partnership with GrapheneOS[1]. It seems that such things shouldn't really happen on a device where security is a top priority, whether intentional or not. 1: https://news.ycombinator.com/item?id=47214645 https://news.ycombinator.com/item?id=47214645
- microtonal 5mo agoWhy does it matter? The GrapheneOS team will make the OS images. So as long as the phone is unlockable, has up-to-date firmware bundles, etc. who cares?
- Retr0id 5mo agoGrapheneOS may be de-googled but it is not de-blobbed, they rely on the vendor to maintain certain drivers etc. Hopefully the driver maintenance team is very separate from the bloatware installation team, but someone could reasonably worry that they're tarred with the same brush.
- microtonal 5mo agoI would guess that most of the driver development is done by Qualcomm for phones with Qualcomm SoCs. At least that is what I've seen looking at the firmware/driver bundles some Qualcomm-based phones. (Of course, there is more, like camera firmware, etc. but they are typically provided through the hardware providers.)
- phoronixrly 5mo agoI was just wondering that... GrapheneOS team consider Fairphone to be infosec plebs, but instead partner with a company that intentionally harms users' privacy for profit?
- bushwart 5mo agoI don't see how the former has anything to do with the latter.
- p0w3n3d 5mo agoIs Motorola Chinese by any chance? I remember the Motorola company has been split to phones and the rest
- petu 5mo agoOwned by Lenovo, yes
- noduerme 5mo agoI like the Stylus G better than most phones I've owned, but Motorola really needs to end its partnership with the offensive "Glance" ad platform. There should not be a third party app like that which keeps re-enabling and reinstalling on every update. I don't understand what Motorola would get out of a partnership with a scammy third rate ad market that would be worth pissing off so many of their customers, but maybe they have some high level corruption in the company.
- andyjohnson0 5mo agoI have a Motorola G70, so this is concerning. But its hard to believe that this is a deliberate action by Motorola. To me it seems more likely that an update was compromised. Still bad though.
- rainforest 5mo agoNote that the smart feed "feature" is Taboola-provided adware[0] so it's par for the course. It's beyond comprehension Lenovo would trash the brand by shipping it on flagships. [0] https://www.reddit.com/r/motorola/comments/1s61usi/edge_60_pro_showing_adds/ https://www.reddit.com/r/motorola/comments/1s61usi/edge_60_p...
- consp 5mo agoThe point where they trashed the brand has long since passed, tried the phones when they bought the brand and it was OK for a while but went downhill quickly.
- GuestFAUniverse 5mo agoUntil now I waited for their GrapheneOS-based phones. If there isn't a plausible follow up to this injection I don't think I will buy I device from them.
- futune 5mo agoI had the same reaction.
- microtonal 5mo agoWho outside Apple/Google/Fairphone isn't? Samsung has been shipping the Israeli (IronSource) AppCloud on A series for a while now and people in some regions even spotted it on S-series phones (it'll spy on your usage and install apps). Nothing, which uses clean Android as one of their selling points, started installing something similar (AppServices, presumably also from IronSource given the Aura branding) on various devices. Between these companies pushing adware/spyware and Apple putting Apple Creator Studio ads in former iWork applications, ads for Apple Intelligence in the system settings, and pushing ads for their F1 movie in Apple Wallet, smartphones have reached the mass enshittification phase. The only safe havens are Pixel with GrapheneOS and Fairphone with I don't know what exactly (Murena sorta has ads for their own stuff and has many other issues, I guess LineageOS then). Perhaps ironically, given the context, Motorola with GrapheneOS too :).
- dmos62 5mo agoI've a Xiaomi phone on which twice appeared obviously debug/hello-world notifications (something like "testtest111") from apps I've never seen or installed. Then another time all Xiaomi phones of close relatives started getting these cheap, spammy ads for Android games in the notifications, this time from some obscure system app: had to look up on reddit that there are settings that disable this specific behavior. The degree to which I don't own my own device is insane.
- xnickb 5mo agoAnd it's about to change soon. https://keepandroidopen.org/ https://keepandroidopen.org/
- shantara 5mo agoI gifted my mom a Xiaomi phone a few years ago. Even after removing all the unnecessary apps and permissions, disabling all the privacy invasive settings and replacing the launcher with the stock Android, I was shocked when I checked the PiHole dashboard. The phone was constantly trying to communicate with dozens of different domains and endpoints, even when idle. None of these attempts had any sort of backoff, so they kept retrying every 30 seconds, draining the battery. Ultimately it generated several times more blocked requests than every other device on my network combined. This was the first and only Xiaomi device I ever bought, no matter how attractive they might seem.
- davidelettieri 5mo agoWith the digital wellbeing app feature it is possible to set a timer of 0 minutes on all auto-installed and auto-reenabling apps to effectively disabling it for good. Edit: the timer stays even after updates so the app is not enabled again
- metalman 5mo agoIt is laborious to go through all the apps on a phone and dissable the default unessesary "open web link" feature on ALL the apps, but apparently it has some effect in reducing the "draft" from all the back doors
- codedokode 5mo agoThink how bad the market got. Today we have preinstalled garbage apps like LinkedIn, garbage apps mandated to be preinstalled by the government, ads, cloud accounts, notifications spam, telemetry. This is not only Chinese smartphones, for example Samsung also plays this game. I assume there are Chinese backdoors, American backdoors and national government backdoors on almost every phone. And there seems to be no way to buy a "free" smartphone without Google Services and telemetry below $250. Why 250? Because free OS have multiple bugs and issues and it is not rational to pay more than that. I am considering two options, one, try to clean up and patch the firmware for a cheap smartphone (remove almost everything proprietary including Google Services, Unrusted Execution Environment, except for basic GUI and launcher), or two, port something like Lineage OS to my phone. Also I need to examine the network traffic and scan for potential weak points like SUID binaries. It is scary to think how much time I will have to waste for this. Also, it is pretty stupid, in my opinion, to make an OS not based on Android, for example, use Qt for GUI, because there will be no apps for it.
- tomaytotomato 5mo agoThe paranoia is completely warranted, but there is a solution. Just root your Android phone and put a custom ROM like LineageOS etc If you want a stretch goal try and de-Google yourself, I have tried but failed twice now.
- qwertytyyuu 5mo agoDo the support the razr?
- ux266478 5mo agoEasier said than done in the US. Even of the phones that allow for rooting (which is few and far between these days) you're at the complete mercy of the carrier for whether or not that ability is actually available to you. Even if the gracious lords may allow it, you have to engage in a long and drawn out Byzantine rite just for the privilege. Currently sitting on a Pixel 10 that will not let me have root. Give me a Linux phone with halfway decent modem drivers, or give me death.
- amelius 5mo agoSince Uber, Airbnb and Tesla, now every company thinks they can do borderline illegal stuff to make an extra buck. What is next? Our banks selling our payment histories to the highest bidder?
- Ekaros 5mo agoIsn't credit ratings pretty much that? Buy the payment history on debt and then sell some derived value to anyone willing to pay?
- like_any_other 5mo ago> What is next? Our banks selling our payment histories to the highest bidder? They do it for your own good, so that you get "more opportunity for consumer experiences in stores and online." https://en.wikipedia.org/wiki/Card_transaction_data https://en.wikipedia.org/wiki/Card_transaction_data https://pirg.org/edfund/resources/how-mastercard-sells-data/ https://pirg.org/edfund/resources/how-mastercard-sells-data/
- pjmlp 5mo agoYeah, I miss the days of multiple choices on mobile phone OSes.
- realusername 5mo agoNotice that this will pass Play Integrity while your clean rom won't.
- zx8080 5mo agoVertical videos converted to 16:9 are bad for your readers, Mr Senior Editor. > Ben Schoon is a Senior Editor Thank you so much for being not able to consume the screencast video in the article.
- zb3 5mo agoThis is why we need to fight for the right to unlock the bootloader, not only on flagships.
- 0x59 5mo agoIts a source of revenue that doesn't harm the user and cannot be disabled by the user. It's the gold standard.
- Retr0id 5mo agoI recently got a Samsung A07 to run some tests on. It's stunningly cheap at <£100, and will supposedly get 5 years of software/security updates. After setting it up, I was surprised (but also not surprised) to see ads on the lock screen. The "feature" is called Glance and while it can be disabled in the settings it took me the help of a video tutorial to actually locate the setting.
- password4321 5mo agoOn my Motorola G Stylus 2025 ($400 MSRP) I have to disable Glance after every reboot (search Glance in Settings then click Disable and Force Stop). Archive/Delete is disabled. Fuck Glance with all possible fuckery.
- shawn_w 5mo agoI only had to disable it once on mine, after going crazy for a while trying to figure out what had messed up my lock screen. Haven't had it try to come back once. Also stopped it from updating automatically in the play store... Still enough shenanigans to make me go to another brand with my next phone. I always liked Motorola phones for being fairly stock without a lot of bloat ware, but that time seems to be in the past.
- subscribed 5mo agoMaybe you can disable it with ADB?
- rbbydotdev 5mo agoThat sounds like a violation of affiliate t&c ? Wouldn't that nullify them, and even lead to lawsuits?
- theologan 5mo agoMost non-triumphant.
- marcusholt 5mo agoYour phone is now a vending machine that charges you for the privilege of inserting coins. The product was never the phone.
- thenthenthen 5mo agoIsnt Motorola basically a ‘Shanzhai’ (copy cat) brand now? Some dude putting the logo on some OEM parts? I am thinking of that Commodore phone from a while back and others. While completely speculative, it is interesting to see legit brands go Shanzhai or get Shanzhaied and Shanzhai brands go legit (xiaomi, huawei)
- hakfoo 5mo agoEspecially outside the flagship market, "shanzhai" is enough. I bought a $250 Motorola (G Stylus 2024 model) I wasn't looking for unique and breakthrough experiences. I just wanted good-enough screen/camera/battery life/performance, which can be presumably be produced from a wide assortment of more-or-less off-the-shelf parts. I am annoyed at the software degradation though. I don't appreciate the repeated unskippable prompts to set up Glance. I feel like when I bought the Ultimate Shanzhai Experience (a Umidigi F1 Play back in the Android 9 days), they didn't pull noxious bait-and-switch software tricks.
- thenthenthen 5mo agoUltimate Shanzhai Experience sounds like a great title for a game
- daft_pink 5mo agoWhy would Amazon pay out on scam affiliate links? That’s the thing I don’t really understand from the honey scam.
- Retr0id 5mo agoAs long as real customers are buying stuff, what incentive does Amazon have to question the source?
- wat10000 5mo agoIf they're paying out on purchases that otherwise would have been organic, they're losing money.
- advisedwang 5mo agoBecause they are forking over some of their revenue to affiliates. If there is no affiliate, Amazon keeps that money for itself. Paying the affiliate only makes sense if it's driving purchases that wouldn't have happened otherwise.
- wat10000 5mo agoIf we're going to imprison people for things like guessing user IDs, this surely ought to count as criminal unauthorized access to a computer system.
- darepublic 5mo agoWe've all got a powerful computer in our pockets but the catch is they are locked down and hostile to our best interests
- wolvoleo 5mo agoThis is the manufacturer trusted by grapheneos to make secure phones for us. Hmm. Of course the software side will be run by grapheneos but a company that has this guile I don't want to trust with even their hardware.
- surcap526 5mo ago[dead]
- metiscus 5mo agoIt looks like devicenative "accidentally" deleted their documentation page that was linked from that article. Fortunately someone archived it beforehand. Oops. https://web.archive.org/web/20260526042018/https://docs.devicenative.com/moto-integration/ https://web.archive.org/web/20260526042018/https://docs.devi... Also, as of some hours ago Motorola has stopped the activity but didn't say anything about how it started in the first place. https://9to5google.com/2026/05/27/motorola-amazon-app-unintended/ https://9to5google.com/2026/05/27/motorola-amazon-app-uninte...