Overview
- Security firm Bitdefender publicly disclosed the campaign on October 9, 2026, after detecting a system file that revealed a firmware-embedded framework delivering hidden apps on low-cost phones.
- The infection has been observed on thousands of devices across more than 150 countries, with measurable shares in Mexico, France, Germany and other markets.
- The malicious firmware runs as a system app and can silently install apps, perform ad and click fraud, act as a proxy, read and send SMS, and run remotely downloaded code.
- The malware can temporarily disable the Google Play Store to evade Play Protect and survives normal app removal or factory resets unless the firmware is reflashed or the device is replaced.
- Investigators found firmware signed with certificates linked to a Shenzhen manufacturer but say that technical traces do not prove who inserted the code and many owners still lack practical ways to remove the threat.