What is the of the device? (e.g., Joying Car Stereo, T95 Android Box)
Several strains of Android adware (often disguised as "Flashlight" or "PDF Reader" apps) have been observed silently downloading update.zip files to hidden directories. mnt/media_rw/udiskh/update.zip
: The standard filename the system looks for to trigger an update. What is the of the device
If you did not connect a USB drive with the intention of updating your phone, delete mnt/media_rw/udiskh/update.zip immediately and scan your device with a reputable mobile security scanner (e.g., Malwarebytes for Android) to check for the process that created the file. Joying Car Stereo