Roughly one in two smartphones sold in Africa is made by a company most buyers have never heard of. Transsion, a Shenzhen-based manufacturer, owns the Tecno, Infinix and Itel brands, which together accounted for about 48% of African smartphone shipments in 2025 – more than 40 million of the 84.4 million handsets shipped on the continent last year, according to Omdia data.

New research has decrypted what those phones send back to their maker. An independent security researcher who publishes as Buchodi, working with the mobile security firm NowSecure, took apart the software on a Tecno Spark 40 and found a built-in tracking system that reports a user’s precise location, which apps they use, how much data each app consumes and even the moment an app switches on the camera.

Transsion devices ship with a first-party data collection system the company calls Athena, paired with a cross-app tracking component called oneID. Both report to servers on the shalltry.com domain, which belongs to Transsion.

The traffic is encrypted, which is why what the phones send has until now been a black box. But the encryption was, in effect, decorative: the key needed to unlock it was hidden inside the phone’s own software.

Once decrypted, the data is detailed. A single record captured from the phone’s own Settings app reported a user’s GPS coordinates in Nairobi along with nearby mobile masts and their signal strength. Other records showed which app was on screen from moment to moment and which app had just opened the camera, though not what it was filming.

Another report listed how much data more than 60 individual apps had used in a single day, including the M-Pesa mobile money app and messaging, betting and loan apps.

Crucially, all this data is tied to roughly 14 permanent device identifiers that a user cannot reset. This creates a common thread linking every captured event back to the exact same handset over its entire lifespan.

Why it matters

Ordinary Android apps run in a sandbox and see only their own activity. On Transsion phones, the collection software runs as a privileged system component, wired into parts of Android a user cannot uninstall: the Settings app, the system interface, the camera service and a hub app called com.hoffnung, labelled “TPMS” on the device. That app can read the clipboard in the background, see every installed app and force-stop other apps. Because it is baked into the operating system, it cannot be switched off, and trying to remove it can leave the handset unusable.

That is not news to the security community: owners of Infinix phones complained on the XDA developer forums as far back as December 2023 that removing the com.hoffnung package sent their phones into an endless restart loop, and that it made frequent connections to a server run by Alibaba. The shalltry.com domain has long appeared on tracker blocklists; the new research explains what those connections were carrying.

There is a cost dimension, too. The uploads travel over whatever connection the phone has, which for many owners means their own prepaid mobile data. One Infinix owner who traced the traffic in 2023 counted around 25 connections every half hour. While the individual tracking beacons are small and the research does not quantify the total daily volume, the system cannot be switched off. Whatever data it consumes comes directly out of the owner’s airtime balance without ever being asked.

NowSecure’s own headline says the data is exfiltrated “to China”. The research itself shows the data going to servers in Alibaba Cloud’s Frankfurt region, in Europe, behind a content delivery network. Transsion is Chinese, and the researcher found references in the data to a ByteDance analytics pipeline and the ad firm Taboola. But the Chinese link rests on who owns the system and where its data may flow onward, rather than on an observed transfer to servers inside China.

Not only Transsion phones

The reach extends beyond Transsion’s own handsets. The research found the same tracking software bundled inside popular apps that run on any Android phone, including the Transsion co-owned music service Boomplay, the pay-TV app StarTimes and Orange’s self-service app. There it is an ordinary app library rather than a system component.

Not everyone sees the inclusion of the tracker in third-party apps as the real scandal, however. Dominic White, MD for South Africa and ethical hacking director at Orange Cyberdefense, called the app-embedded version of the software development kit (SDK) “a bit of a red herring”.

“Most applications have all sorts of app analytics SDKs embedded within them that capture all sorts of creepy analytics about an app’s usage, even including things like phone orientation and screen brightness,” he said, though app-level trackers are confined by Android’s sandbox, unlike the system version on Transsion phones.

What owners can do

Because the software cannot be removed, the only reliable defence is to block the traffic before it leaves the phone. The researcher recommends a wildcard block of the domains *.shalltry.com and *.transsion-os.com, using a tool such as Pi-hole, NextDNS or an on-device DNS filter. Blocking single server names will not work, as the system rotates through addresses.

Shayimamba Conco, security evangelist for Africa at Check Point Software Technologies, said users should also cover the basics, though standard defences of this kind offer limited protection against tracking built into the firmware itself.

“Ultimately, device manufacturers also have a responsibility to provide clear disclosure about what data is collected, why it is collected, and to give users greater control over their personal information.”

Every modern smartphone collects some telemetry, and White cautioned against treating Transsion as a lone bad actor. “While the article clearly shows that there is a lot of data collected and associated with a persistent identity, that is the unfortunate reality for most of our devices these days.

“Google and Apple certainly collect approximately three-quarters of the same data on their devices,” he said. “That doesn’t make it okay; I think we have a problem where there is a dramatic overcollection of all sorts of nuanced data used in all sorts of unknown ways, with oblique references in the fine print of ever-longer privacy policies.”

Where Transsion goes further, White said, is in the detail: per-app network usage, moment-to-moment tracking of the app on screen and camera activity. He noted that Transsion, like its larger rivals, discloses much of the collection in its privacy policy, “although the granularity of it, and some of the detail like camera usage is not disclosed in appropriate detail”.

TechCentral reviewed the policy, last updated in July 2021. It discloses many of the categories, including app usage, per-app data usage and install and uninstall events, but classifies them as non-personal information that “cannot be used to identify an individual”, while the decrypted traffic shows those events tied to permanent device identifiers.

It describes location collection as consent-based and restrictable in the phone’s settings, whereas the research found the Settings app itself sending location as telemetry. Camera activity is not mentioned at all.

In practice, few people read privacy policies, least of all a several-thousand-word document on a manufacturer’s website. Nothing on the phone itself discloses the tracking, asks permission or offers a way to decline it; for most Tecno, Infinix and Itel owners, reporting like this will be the first they hear of it.

Control

For White, the most important difference is control. “Apple allows a user to turn off a significant amount of the data collection, or have their data anonymised, Google is more reluctant to, but a user still has some control over collection. The Transsion stuff, however, looks like it gives the user no control over whether it’s sent or identified as theirs,” he said. That lack of control, he added, is “a problem they need to be forced to address”.

NowSecure sells mobile security products and its blog post promotes them, so it has a commercial interest in the findings drawing attention. The technical work, however, is credited to an independent researcher, described as reproducible from the phone’s firmware, and matches what device owners documented years earlier.

Read: South African smartphone buyers say ‘howzit China’

And to be clear about what the telemetry is not: there is no evidence it records calls or what the camera sees (so-called “spyware”). It is unremovable data collection, not interception.