New Android Phones Shipped With Preinstalled Malware

Budget Android phones have been discovered with preinstalled firmware-level malware, compromising their supply chains before reaching consumers. These compromised devices were shipped globally, affecting thousands of users across approximately 150 countries. The malware was designed to generate fraudulent ad revenue by displaying invisible ads and also repurposed infected phones into residential proxies for illicit activities.

Security researchers identified specific models from manufacturers such as Doogee and Cubot, as well as imitation devices, that were affected. These phones often utilized MediaTek chipsets, allowing attackers to gain elevated privileges and execute remote code. The malicious applications, disguised as everyday tools like weather or file manager apps, were difficult to remove, frequently requiring technical firmware-level intervention or Android Debug Bridge (ADB) for cleanup.

Some malicious applications were also found on the Google Play Store, though these typically required user permissions that might have raised suspicion. Bitdefender's investigation revealed 32 malicious apps in total, highlighting the pervasive nature of this threat. The easiest solution recommended by experts is to avoid purchasing devices from brands with questionable reputations to prevent potential malware infections.