Researchers believe the malware is installed by third parties but couldn’t pinpoint their location.
Malicious software targeting smartphones with the Android operating system is becoming more common, with some handsets already infected when they’re bought.
A report by German security firm G DATA found that the samples containing such malware had increased by 25 percent in the second quarter compared with the first three months of the year.
The company’s 10th such report, released Wednesday, found that analysts could identify a new strain of malware every 14 seconds.
It says some phones by manufacturers such as Huawei and Xiaomi contain modified apps designed to spy on users or display advertising.
G DATA spokesman Christian Lueg says the phones appear to have been installed by middlemen, but in tracing the source “we lost the trail in China.”
Users can detect the malware with free software.