{"id":383251,"date":"2026-04-09T13:46:10","date_gmt":"2026-04-09T13:46:10","guid":{"rendered":"https:\/\/www.newsbeep.com\/il\/383251\/"},"modified":"2026-04-09T13:46:10","modified_gmt":"2026-04-09T13:46:10","slug":"a-mysterious-ghost-admin-is-digitally-bricking-samsung-phones","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/il\/383251\/","title":{"rendered":"A mysterious ghost admin is digitally bricking Samsung phones"},"content":{"rendered":"

\"samsung<\/p>\n

Ryan Haines \/ Android Authority<\/p>\n

TL;DR<\/p>\n

Galaxy S22 Ultra owners are finding their retail phones claimed by a shady company called \u201cNumero LLC\u201d after performing factory resets.
\nThe lockout happens via Samsung\u2019s servers at the IMEI level, meaning factory resets and manual firmware flashing cannot bypass it.
\nAffected users are stuck between Samsung and Knox support teams, neither of which currently claims to have the tools to fix the records.<\/p>\n

Samsung Galaxy phones are among the best you can buy for enterprise use, thanks to features such as hardware root of trust via Knox Vault<\/a>, an irreversible e-Fuse to detect firmware tampering, and the Knox Suite<\/a> for managing devices at scale. But over the past few months, non-enterprise users have been encountering a \u201cdigital brick\u201d scenario that weaponizes some of these very features, effectively locking them out of their own phones.<\/p>\n

The \u201cThis device isn\u2019t private\u201d trap<\/p>\n

We\u2019ve spotted several Galaxy S22 Ultra owners complaining (1<\/a>, 2<\/a>, 3<\/a>, 4<\/a>) that their phones are allegedly locked after a factory reset.<\/p>\n

The sequence is identical in almost every case: After a reset, users connect to Wi-Fi to begin the standard Android setup. However, before they can sign in to their Google account, they are intercepted by the Knox Mobile Enrollment<\/a> (KME) Provisioning Screen with the message \u201cThis Galaxy S22 Ultra isn\u2019t private,\u201d stating that the phone is managed by an organization and that all data and activity are visible to a remote IT admin.<\/p>\n

\"Galaxy\"Galaxy<\/p>\n

However, the kicker here is that the phones are allegedly not provisioned through an organization at all and are not part of a corporate fleet. These phones are said to have been purchased through Samsung via standard retail channels, with no affiliation or connection to any company.<\/p>\n

\"Galaxy<\/p>\n

There are a few telltale signs of this being shady. For starters, the admin app is titled \u201cSAMSUNG ADMIN\u201d in all caps, and bears the logo with the words \u201cFRP UNLOCK SAMSUNG.\u201d The company mentioned is \u201cNumero LLC,\u201d which doesn\u2019t appear in US company records (one of the screenshots shows \u201c5G UC,\u201d which means the phone is on T-Mobile\u2019s \u201cUltra Capacity\u201d network, and thus based in the US), though we could spot a link to South Korea<\/a>.<\/p>\n

Don\u2019t want to miss the best from Android Authority?<\/p>\n

\"google\"google<\/a>Factory resets won\u2019t help you get your phone back<\/p>\n

Users have attempted to bypass this by performing multiple factory resets and even manually flashing firmware with Odin, but the lock remains. This is because the handshake happens at the IMEI level.<\/p>\n

When the phone pings Samsung\u2019s Attestation servers during setup, the servers check their database and see that the IMEI is \u201cclaimed\u201d by Numero LLC. It then pushes a mandatory MDM (Mobile Device Management) profile to the phone. Because this occurs at the firmware level within the Setup Wizard, the user is stuck in a \u201ccatch-22\u201d: accept a compromised phone with a remote \u201cghost\u201d admin, or end up with a phone that cannot be activated or used.<\/p>\n

Another possibility is that attackers may have exploited vulnerabilities in Knox, such as the recent CVE-2026-20978<\/a>, spotted in KnoxGuard, which allows unauthorized parties to bypass ownership checks and tamper with enterprise management settings. However, this requires having physical access to the phone at some point.<\/p>\n

The \u201cFRP Unlock\u201d branding also suggests that these hijacks might be a side effect of users previously using shady third-party unlocking services that may have harvested their IMEIs.<\/p>\n

If you find yourself on this screen, your only legitimate recourse is to contact Samsung Support with your original proof of purchase and demand an \u201cIMEI Unenrollment.\u201d However, users report being stuck in a support loop: Samsung Support redirects them to Knox technical teams, who claim they lack the tools to modify enterprise records, and then redirects them back to Samsung Support. So brace yourselves for a phone that\u2019s been digitally bricked.<\/p>\n

We\u2019ve reached out to Samsung to learn more about this issue. We\u2019ll keep you updated when we hear back from the company.<\/p>\n

Thank you for being part of our community. Read our\u00a0Comment Policy<\/a> before posting.<\/p>\n","protected":false},"excerpt":{"rendered":"Ryan Haines \/ Android Authority TL;DR Galaxy S22 Ultra owners are finding their retail phones claimed by a…\n","protected":false},"author":2,"featured_media":383252,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16],"tags":[992,85,46,321,1523,69947,125],"class_list":{"0":"post-383251","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-mobile","8":"tag-authority-insights","9":"tag-il","10":"tag-israel","11":"tag-mobile","12":"tag-samsung","13":"tag-samsung-galaxy-s22","14":"tag-technology"},"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/383251","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/comments?post=383251"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/383251\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media\/383252"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media?parent=383251"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/categories?post=383251"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/tags?post=383251"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}