CoolReaper can also see or delete SMS messages, send messages, delete user data, uninstall or disable applications, and even make phone calls to any number.
"This kind of complete control, hidden control, this is new," Olson said.
So far, the CoolReaper application has only been found on Chinese versions of the Coolpad smartphones, he added.
"They're also selling in other parts of Asia and Europe," he said. "But they have different models in different regions."
Olson added that it's never a good idea for a manufacturer to install a back door on a device.
"When you create a backdoor, you think it's only going to be used by you," he said. "But you've purposefully made the system less secure."
Sign up for CIO Asia eNewsletters.