Malware Discovered Preinstalled on Thousands of Cheap Android Phones

Overview

• Security firm Bitdefender found a campaign that ships malware inside the system firmware of thousands of low‑cost Android phones that are active in more than 150 countries.
• The malicious component runs as a system app with elevated privileges, survives factory resets, and cannot be removed by ordinary users without reflashing firmware or using developer tools like ADB.
• The firmware enabler pulls code from remote servers, collects device identifiers, grants itself Accessibility, Notification and SMS rights, and installs a rotating set of at least 32 disguised apps that carry out fraud.
• Those dropped apps use legitimate ad SDKs to show invisible overlays, register fake ad impressions and clicks, and can turn infected phones into residential proxy nodes for botnets and other abuse.
• Because the infection is embedded before first boot, responsibility for durable fixes falls to device vendors, firmware integrators and the marketplaces that sell these MediaTek‑based and counterfeit budget models, while owners face limited practical remediation options.