A Chinese X user says local police phoned his friends and told them to delete X and Telegram. Then he took apart the software on one friend’s Xiaomi phone.
He believes it shares app lists with outside servers. He also says it records short screen clips for review. The post spread fast over the weekend. Still, Xiaomi, China Unicom, and police have not confirmed any of it.
Details of the X user’s claims
The user posts as MeT, with the handle @MeTerminator666. On October 31, he wrote that some friends with Chinese-made Android phones got calls from local police. The officers asked them to remove X and Telegram. One friend owns a rooted Xiaomi 14. Rooting means the owner unlocked full admin control.
MeT first suspected a leak from a badly set up VPN. However, he thought that was unlikely. So he checked which apps on the phone report app lists. He now urges people not to use Chinese-made phones to get past the Great Firewall.
He also warns against installing foreign apps on them. According to a Vietnamese forum summary of his post, GPT helped with the code analysis.
The app list claims
MeT highlighted two built-in software components. The first is SystemHelper. This software, according to him, watches all applications installed on the smartphone and analyses those that were used within the past 24 hours.
It also analyzes this use in terms of data traffic. Its data includes the phone’s and SIM card’s ID numbers. He claims that it sends information to the website of China Unicom – one of the largest telecom operators in China.
The second one is the System Security Component. According to MeT, this sends a list of non-system applications to Xiaomi’s anti-fraud system. That list includes information about the application’s names, version and signature. Furthermore, the report includes analysis results of suspicious applications.
The screen clip claim
This is the most shocking statement made by MeT. He claims that this piece of code makes a recording of the screen for about three seconds. Afterward, the recorded video is encoded and sent to Xiaomi’s cloud service.
A server gives its verdict on the risks. If it finds no risk, the phone deletes the clip. After two seconds, it takes another record. If it discovers some risks, the mobile device stores the clip, warns about it and shuts down the service.
What Xiaomi’s own documents say
Xiaomi has published related details. In April 2026, its developer site described a fraud check tool. It can detect screen sharing, screen recording, SIM calls, and internet calls. Likewise, Xiaomi’s privacy policy lists app lists and app use among the data it may collect.
Concerns about Chinese cyber operations extend beyond smartphone monitoring, with reports also highlighting how Chinese hackers use proxy networks to hide their activity and evade detection.
Even so, those documents do not prove MeT’s specific claims. ETtoday, a Taiwan news site, made the same point. The documents do not confirm the named programs, how often data moves, or the recording steps.
First, MeT tested one rooted phone. Other Xiaomi phones may act differently. Second, he has not checked whether the system installs the programs again after removal. Third, no evidence shows that this data reached police or caused the calls.
Meanwhile, a GitHub post with matching details appeared on November 2 in uBlock Origin’s issue tracker. A volunteer noted that the tool only blocks browser traffic. Maintainers labeled the post invalid and closed it. As of Monday, neither Xiaomi nor China Unicom had publicly responded, based on the sources we found.
Similar earlier reports tied to Xiaomi phones
This is not the first claim of this kind. In 2023, reports said Xiaomi’s MIUI software flagged Telegram as fraudulent on phones in China. A developer told BleepingComputer those reports were true.
At the time, MIUI tried to remove apps it deemed dangerous and block new installs. That detail matters here, because it shows Xiaomi’s phones already act on app lists. Yet claims that the flags reached the police stayed unproven.
Xiaomi has also denied past accusations before. In early 2022, a spokesperson reportedly said its anti-fraud feature should flag spam calls, not apps. In 2021, Lithuania’s cyber agency said Xiaomi phones carried censorship tools that could be switched on remotely. Xiaomi rejected that claim and promised an outside review.
Later, in March 2024, Radio Free Asia reported police spot checks of phones for tools that bypass the Great Firewall. Some residents also said police pushed them to install an approved anti-fraud app.
What MeT advises
MeT suggests that people who need foreign apps use an overseas iPhone. Another option is to choose a phone running a standard Android OS without Chinese enhancements.
Still, these are just an individual user’s observations and should serve as a lead for further investigations, not a verdict. To clear all possible doubts, there’s a need for independent testing.
