Recently, certain carriers have introduced a new method for installing adware on Android for Work devices using service applications. These service applications, which may be included on select devices, allows carriers to push new applications to the devices without warning or going through the standard Android package manager. Applications installed are badged to look like Android for Work applications and can include advertisements, games, and entertainment applications as seen in the following screenshot:
When the device is enrolled into Android for Work, the applications are reported as Work Managed in the Workspace ONE UEM (AirWatch) Console. Additionally, when attempting to uninstall these applications, they may be reinstalled after rebooting the device.
If the application ID is known, a blacklist application control can be pushed to each adware application.
Note: In BYOD scenarios, the same application may have a different application ID per carrier.
Our product team has been engaged and is looking to prevent this behavior for Android for Work devices.