Particle.news
Download on the App Store

Galaxy S22 Ultra Owners Report Phones Hijacked by Rogue Knox Enrollment

An unknown admin labeled Numero LLC takes control during setup.

Overview

  • Owners say factory resets on retail-purchased Galaxy S22 Ultra units trigger Samsung’s Knox Mobile Enrollment, which halts setup with a “This Galaxy S22 Ultra isn’t private” warning.
  • The enrollment screen names an admin called Numero LLC and shows a device admin app labeled “SAMSUNG ADMIN” with a “FRP UNLOCK SAMSUNG” logo, according to the reports.
  • Knox Mobile Enrollment checks a phone’s unique IMEI against Samsung’s servers and auto-loads a management profile, so the lock persists after any wipe or fresh firmware flash.
  • Coverage points to two possible causes: a compromised reseller account that bulk-uploaded IMEIs to Knox, or a recently noted Knox vulnerability that can bypass ownership checks.
  • Phandroid reports that some users were told to seek IMEI unenrollment through Samsung support, yet they describe being bounced between teams with no confirmed fix or public statement.