Overview
- Bitdefender disclosed Monday that thousands of low-cost, MediaTek-based Android phones across more than 150 countries were shipped with a preinstalled system component that users cannot uninstall by normal means.
- The component runs with system privileges that let operators silently install and remove apps, grant Accessibility, Notification and SMS access, and fetch and execute remote code from command servers.
- Researchers found the enabler drops a rotating set of at least 32 disguised 'cover' apps that use legitimate ad SDKs to register invisible ad impressions and clicks and also register devices as residential proxy nodes.
- The same ad-fraud code and server infrastructure showed up in multiple apps on Google Play, and some infected firmware samples were signed with certificates linked to Shenzhen Zediel, though the exact point of supply-chain insertion is unresolved.
- Because the malware sits in the system partition, cleanup usually requires vendor firmware updates, manual firmware flashing, or disabling the component via ADB, options that are impractical for most owners and put pressure on vendors and marketplaces to act.