India Orders Phone Makers to Pre-Install Sanchar Saathi App to Tackle Telecom Fraud

Headline: India Mandates Irremovable Sanchar Saathi App Pre-installation on New Mobile Devices: Supply Chain & Data Privacy Risks

TL;DR: India's government will mandate the pre-installation of an undeletable 'cybersecurity' app on all new mobile devices, raising significant supply chain, privacy, and potential surveillance concerns.

Technical Analysis:

• Affected Platforms: Android, iOS.
• Target Devices: All new mobile phones manufactured for the Indian market, to be pre-installed within 90 days.
• Affected Application: Sanchar Saathi.
• Deployment Method: OEM pre-installation; the app cannot be deleted or disabled by end-users.
• Potential MITRE ATT&CK Mapping:
  • T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain: Government mandate alters the trusted software baseline of devices at the OEM level during manufacturing.
  • TA0003 - Persistence: The application's undeletable and undisableable nature ensures its continuous presence and potential execution on affected devices, leveraging system-level control.
  • TA0009 - Collection: A persistent, unremovable application on a mobile device inherently possesses the capability to access and potentially collect sensitive user data, depending on granted permissions and design.

Actionable Insight:

• For SOC Analysts / Detection Engineers:
  • Develop and deploy network monitoring rules to identify anomalous egress traffic or potential command and control (C2) activity originating from Sanchar Saathi processes or associated known domains/IPs.
  • Integrate endpoint telemetry from mobile devices (via MDM/UEM solutions) to monitor Sanchar Saathi's runtime permissions, resource utilization, and inter-app communication for suspicious behavior.
  • Prioritize investigation of any user-reported issues regarding unexpected device behavior, performance degradation, or increased data usage on devices with Sanchar Saathi installed.
• For CISOs:
  • Mandate a comprehensive risk assessment for all corporate and BYOD mobile devices used by employees operating in India, specifically evaluating data privacy and potential exfiltration vectors.
  • Update mobile device management (MDM) configurations and acceptable use policies to mitigate risks associated with undeletable applications; consider restricting access to sensitive corporate data from affected devices.
  • Explore and implement secure alternative communication channels or virtualized environments for sensitive operations on devices procured or used in India.
  • Consult legal and compliance teams regarding the implications of forced app installation on data sovereignty, privacy regulations (e.g., GDPR, local laws), and organizational liability.

Source: https://thehackernews.com/2025/12/india-orders-phone-makers-to-pre.html