Malware is pre-installed on inexpensive Android phones that the federal government subsidizes for low-income Americans, cybersecurity firm Malwarebytes has announced.

The phones are made by Unimax, a Chinese company; Malwarebytes found an updater app called Wireless Update preloaded on the Unimax UMX U686CL model that installs apps without user permission Malwarebytes discovered that an updater app called Wireless Update preloaded on Unimax UMX U686CL models contains Adups, a notorious Chinese adware strain that can install apps without the user's permission.

This is already pretty bad, but at least the Wireless Update app can be uninstalled, and AdUps generally just installs more adware. Worse, the phone's "Settings" app hides a "dropper" Trojan that resembles known dangerous malware, and the "Settings" app cannot be removed without destabilizing the phone.

"Uninstalling wireless updates may cause you to miss important OS updates. We think it's worth the trade-off," Malwarebytes' Nathan Collier wrote in a company blog post. "But uninstall the Settings app, and you've just made an expensive paperweight."

The phones were apparently sold in the U.S. by Assurance Wireless, a subsidiary of the soon-to-be-shuttered Virgin Mobile, as part of a federal program to provide inexpensive phones to those who cannot afford phone service. The Unimax UMX U686CL was not listed on the Assurance Wireless website as of Friday morning, but the Unimax UMX U683CL model is still available.

These subsidies, officially called Lifeline subsidies, are commonly referred to as "Obamaphones," even though they began in 1985 during the Reagan administration; in 2005, during the presidency of George W. Bush, the program was expanded to include cell phones.

Collier notes that Assurance Wireless sells the Unimax UMX U686CL to Lifeline Assistance recipients for $35, but the Assurance Wireless website suggests that many phones are offered for free.

If you have a Unimax UMX U686CL, best to turn it off and get a new phone. Unimax phones are not the only phones sold as part of Lifeline Assistance. Assurance Wireless offers more than 10 other models, including two other Unimax phones, and many other companies, including AT&T and Verizon, sell Lifeline Assistance phones.

Assurance Wireless' parent company, Virgin Mobile, is owned by Sprint, and Sprint told Ars Technica, "We are aware of this issue and are in contact with Unimax, the handset manufacturer, to understand the root cause, but initial test results, We do not believe that the application being presented in the media is malware."

Ironically, Collier writes that the UMX U686CL is otherwise quite good for a phone that normally sells for $35.

"It's not a bad phone. It feels solid in the hand and runs smoothly," Collier wrote. 'Sure, it's not the fastest mobile device, but it's a fully featured smartphone. In general, without malware, this device is a good option for those on a budget."

Cheap Android phones manufactured by off-brand Chinese companies are notorious for being bundled with adware and sometimes malware. We have documented nearly half a dozen such cases over the past few years.

As always, our advice remains the same: don't buy cheap Chinese phones, and make sure any Android phone is running one of the best Android antivirus apps.