Threat Research: Pre-Installed Android Malware

**Executive Summary:** Twenty-one malicious apps from the Loki and SLocker families were found pre-installed on at least 36 high-end smartphone models sold via unofficial channels (e.g., eBay), with Loki enabling root access and data theft and SLocker performing device-locking ransomware operations; zIPS can detect these apps but fully removing pre-installed infections requires re-flashing the device.