On October 31, 2026, the MeTerminator666 account posted an analysis article on X that caught the attention of many Chinese Android users. MeTerminator666 said that some friends using domestic Xiaomi devices recently received calls from local police, asking to remove X (Twitter) and Telegram applications. One of those devices was a rooted Xiaomi 14 running HyperOS 3, so MeTerminator666 analyzed system components capable of reporting application lists.

Analysis results show two main components

• SystemHelper (com.mobiletools.systemhelper): Tracks active applications in the last 24 hours, lists installed applications (ignoring packages starting with com.android), links to usage statistics and network traffic. The payload also contains IMEI, IMSI, ICCID fields, allowing application information to be associated with device and SIM identifiers. The data is sent to Xiaomi's server and a China Unicom address (dm.wo.com.cn).

• 系统安全组件 (usually com.miui.guardprovider or related to Security Center): Report third-party application list (package name, version, signature, display name), fake application scan results. In particular, it has the function of recording the screen for about 3 seconds (720×1280 resolution, 24 fps), converting it to Base64, encoding and then uploading to the Xiaomi cloud to evaluate "whether it is a risk or not". If no risk is detected, delete the temporary file and continue the cycle; If so, keep it and display a warning.

MeTerminator666 notes that reverse engineering is performed with the support of GPT and recommends that users should not use domestic Android devices to install foreign applications or use firewall circumvention tools, preferring international iPhone versions or pure AOSP ROM.

Confirmed from independent analysis

The above analysis does not stand alone. On October 13, 2026, technology blog ChrisLi-Tech announced the results of reverse engineering on Redmi K90 (HyperOS 3.0.306). Even if a user opts out of the Security Center app's privacy policy, anti-phishing components continue to operate and record:

- Screenshot time

- Screen sharing / screen recording

- List of installed applications

- VoIP calls and phone numbers related to fraud

Data is saved in an internal SQLite database at the path (/data/misc/user/0/securitycenter/fraud_detection_data.db). This system belongs to the XSOF (Xiaomi Security Open Framework) security framework. Many third-party apps (including Xiaohongshu, some Baidu apps, and Alibaba) are granted ACCESS_XSOF permission and can query risk information on the device.

Xiaomi's official developer documentation (HyperOS portal) describes the service “设备涉诈检测” (Device Fraud Detection). This service provides risk scores and behavior flags for partner applications, including: taking screenshots, sharing screens, installing financial/lending/risk apps, suspicious VoIP calls... within a time window of up to 72 hours. The document also notes that some behavior can still be detected even if users have deleted call history or uninstalled the application.

Practical meaning

In China, phone manufacturers are required to integrate anti-phishing (反诈) mechanisms at the system level. The official aim is to prevent phone scams, fake apps and irregular money transfers, a common problem in the country. However, this same mechanism also creates wide-area surveillance capabilities: the device knows what applications the user is installing, whether a VPN/proxy tool is being used, and can record screenshots for analysis.

On a non-rooted device, these components are almost impossible to completely remove using normal methods. The community has developed several LSPosed modules (e.g. AppListUploadBlocker) to block uploading of application lists from guardprovider, but this is only available on rooted devices and has its own risks.

Conclusion and recommendations

Advertisement

The incident shows that on domestic Android devices running HyperOS (and many other Chinese Android ROMs), the line between "protecting users from phishing" and "collecting deep behavioral data" is very thin. If you frequently use foreign apps, restricted social networks, or circumvention tools, using a domestic device carries a higher risk of being detected and asked to remove the app.

Users concerned about privacy are often advised to:

- Priority is given to international iPhone versions or Android devices running ROM close to AOSP (not domestic versions).

- If you must use a Xiaomi/HyperOS device, limit the installation of sensitive applications and consider using a separate device for activities that require security.

- With a rooted device, you can consider solutions to block uploads, but you need to understand the technical and legal risks.

MeTerminator666's original post received more than 1.3 million views in just a few days, showing that this issue is of widespread concern to the community. Independent technical analyzes and official Xiaomi documents both confirm the existence of these data collection and sharing mechanisms, although the stated purpose is to prevent fraud.