You remove Facebook. It comes back. You clear Booking.com. It reappears. You never asked for these apps. You didn’t reinstall them. But your phone did—and when you check your system settings, the culprit isn’t listed in your app drawer or Play Store. It’s embedded deep under a cryptic label: com.ironsrc.aura.tmo.
How com.ironsrc.aura.tmo Works and What It Does
com.ironsrc.aura.tmo is a system-level background process installed on T-Mobile and Metro phones. It powers AppSelector, a preloaded setup utility built by ironSource (now owned by Unity). While it appears to help “personalize” your app experience, its true job is to silently install sponsored apps without user interaction.
Once your SIM activates, the service launches automatically. It scans basic usage patterns, monitors idle states (like extended Wi-Fi sessions), and pushes pre-selected apps onto your device. These apps don’t go through Play Store approval steps. They aren’t presented with opt-in prompts. The install is silent, background, and persistent.
This behavior is granted through carrier provisioning—not through user consent. The package bypasses normal permission requests by being embedded in the firmware image or activated via carrier configuration.
Isn’t malicious by traditional standards—there’s no theft, tracking of messages, or external data leaks. But it’s persistent and built for business logic: the app returns because the system is instructed to reinstall it.
Is com.ironsrc.aura.tmo Safe?
From a security perspective, yes. It doesn’t exploit Android vulnerabilities or act like spyware. It doesn’t collect keystrokes or escalate permissions beyond what the system allows. Antivirus scanners rarely flag it because it follows sanctioned methods for installation and execution.
From a trust standpoint, it’s problematic. The service overrides explicit user action—removing an app—and reintroduces it without warning. That violates the expectation of control.
On devices sold unlocked or without carrier intervention, Aura doesn’t exist. That absence alone highlights what it is: a carrier-specific utility optimized for advertising delivery, not user experience.
Real Behavior Reported by Users
Across Reddit, GitHub, and XDA forums, users report identical symptoms tied to com.ironsrc.aura.tmo and its sister packages. One thread on r/tmobile describes Facebook reinstalling three separate times after deletion, always triggered by an overnight Wi-Fi sync. Another GitHub issue documents the reappearance of Wish, Letgo, LinkedIn, and Pandora after a factory reset—before the user even completed Play Store sign-in.
A contributor on XDA’s system apps forum noted that Aura’s activity isn’t tied to user sessions at all. Instead, it kicks in after baseband provisioning or post-update checks, meaning you can reboot your phone and still get unwanted installs without ever opening AppSelector.
In another thread, a user disabled AppSelector entirely. But TikTok returned after an eSIM profile update. That’s not random—it’s how Aura was designed to operate.
Known Variants of Aura
The Aura service isn’t limited to one region or device. It runs under different package names depending on the brand and localization profile:
| Carrier / OEM | Package Name |
|---|---|
| T-Mobile USA / Metro | com.ironsrc.aura.tmo |
| Samsung Global (OOBE) | com.aura.oobe.samsung.gl |
| Deutsche Telekom | com.aura.oobe.deutsche |
These variants all use the same Aura logic, with slight branding or UI differences. You can identify the running service on your device by installing a tool like App Inspector or Package Name Viewer, then searching under “Show system apps.” The name “Aura” may not appear in the app list—it could be hidden behind AppSelector or a regional setup wizard.
Knowing the exact package name is essential before applying any fix. Using the wrong variant in ADB commands won’t disable the service and may result in no change at all.
How to Disable com.ironsrc.aura.tmo Safely
Aura can’t be removed through the Play Store or traditional uninstall methods. But you can cleanly disable it for your user profile using Android Debug Bridge (ADB). This requires a PC connection and developer options enabled.
Step 1: Turn On USB Debugging
- Open the Settings app on your phone
- Scroll to About phone and tap it
- Tap Build number 7 times until it says you’re now a developer
- Go back to Settings, select Developer options
- Scroll down and turn on USB debugging
- Confirm by tapping OK if prompted
Step 2: Disable com.ironsrc.aura.tmo with ADB
- On your computer, install ADB platform tools if you haven’t already
- Connect your phone to the computer with a USB cable
- Open a command window where ADB is installed
- Run this command to check the connection:
adb devices
If your device is listed, continue. If not, check your cable and drivers.
Now run the uninstall command:
adb shell pm uninstall -k --user 0 com.ironsrc.aura.tmo
Replace the package name if you’re on a different carrier variant, such as:
- com.aura.oobe.samsung.gl
- com.aura.oobe.deutsche
This disables the app for your current profile. It will not affect system updates or break Play Services. It survives reboot, but not a full factory reset.
Step 3: Disable AppSelector (if visible)
Some builds still show AppSelector in the app list. You can disable its frontend this way:
- Open Settings on your Android device
- Scroll down and tap Apps (or App Management depending on your phone brand)
- Tap All apps or Manage apps to view the full list
- Select Show system apps
- Look through the list and locate AppSelector. If it’s missing, try searching for:
- App Manager
- Aura
- Device Setup
- AppCloud
- Tap the app name to open its info screen
- Press the Disable button
- If a warning pops up, confirm to complete the action
This step blocks the UI from recommending or requesting new installs, but it does not stop the engine behind Aura unless paired with ADB.
Step 4: Clear Stored Behavior Data
- From the Settings, go to Apps or App Management
- Tap All apps to open the full list
- Use the search bar or scroll to find AppSelector
- Tap on it, and select Data or Storage & cache
- Tap Clear cache, then select Clear data
- Exit settings when done
This removes any stored installation queues or behavior flags. It can help reduce recurrence if the backend is ever reactivated.
Avoid using root-based “bloatware removers” unless you understand the risk. Improper system partition edits can trigger OTA update failures, break SafetyNet, or cause app crashes. If you’re rooted, freezing the package is safer than deleting it.
Final Take
com.ironsrc.aura.tmo isn’t just an annoyance—it’s infrastructure for sponsored distribution. It’s not installed by accident, and it doesn’t misbehave unintentionally. It’s engineered to override decisions, reintroduce content, and quietly increase app adoption metrics that benefit carriers and advertisers.
This model of preemptive reinstallation blurs the line between personalization and forced adoption. You’re not being asked what to install—you’re being informed after the fact, if at all. It’s a shift in design: from consent-first to opt-out-if-you-can.
That’s not a system error. That’s a monetization strategy.
Related articles:
