Experts warn cheap Android phones are being shipped with malware built in, so be on your guard

Budget Android phones shipped with firmware-level malware preinstalled before reaching customers Malware generated fraudulent ad revenue and turned infected devices into residential proxies Victims spanned 150 countries, with cleanup often requiring firmware-level remediation Imagine buying a brand new, sealed Android phone, and later realizing it came with preinstalled malware rooted deeply into the firmware and thus almost impossible to remove - generating fraudulent ad clicks for a malicious third party, and even turning the phones into residential proxies to be used for whatever sinister purposes.

Security researchers Bitdefender found an unidentified threat actor managed to compromise the supply chain of multiple smartphone manufacturers and added malware on a firmware level before the devices were even shipped to stores.

A number of brands were mentioned, including Doogee S200 X, Doogee Fire 3 Max, and Cubot KINGKONG X - both Chinese smartphone manufacturers building budget, rugged Android phones .

The reports also mention ripoff devices impersonating Samsung and Apple products.

In general, these are devices using MediaTek chipsets, which were infected in a way that allowed the attackers to tamper with applications, grant themselves higher privileges, and even do remote code execution (RCE) attacks without the victim’s knowledge.

Victims across the world Unfortunately, these devices were shipped all over the world, and Bitdefender claims “thousands” of people were victims, scattered across some 150 countries around the world, with the highest concentration found in Mexico, France, Italy, United States, Germany, Brazil, and Spain.

The malware comes in different shapes and sizes.

So far, Bitdefender uncovered 32 malicious apps, including those pretending to be weather apps, file managers app lockers, OCR tools, and audio editors.

All of these do the same thing - create an invisible overlay over different apps and register an ad being viewed, despite the fact that the user never actually saw it.

That way, whoever installed the malware scams the ad network into thinking the ad was served to thousands of users which, in turn, generates profit.

We don’t know exactly how many devices are compromised this way, or how much money the crooks stole this way.

"The system app itself doesn’t register the fraudulent impressions and clicks," Bitdefender said.

"The revenue engine is driven by the dropped cover apps, including real-looking weather, app-lock, note, and OCR apps, which load genuine ads through a legitimate ad SDK.