Is it even surprising these days when you open up a brand new phone, expecting nothing but a clean installation with which you can do anything you please, only to discover the carrier has installed tons of their own, bloated software? In fact, I was surprised to find no bloatware on my Telus Milestone.

Well, last week, a Panda Security employee received a brand new Vodafone HTC Magic, and when she plugged it into her PC, Panda Antivirus discovered several malicious pieces of malware. The botnet installed is fairly basic, but once connected to the internet, it connects to a server run by the software creator, in order to deliver personal information, such as passwords and credit card numbers, to an external database.

While Vodafone denies this is a widespread issue, it brings the question of quality control into focus, whether on HTC or on the phone carrier, though realistically, HTC probably delivered the phone completely clean, and lets the carrier install any aftermarket software on top of the OS.

This will most likely not be the last time we see malicious software installed on a clean phone. But as customers we cannot be complacent either. Do a scan on the files on your phone, let us know if you come up with anything!