Experts warn cheap Android phones are being shipped with malware built in, so be on your guard

A recent warning from security experts highlights the alarming issue of budget Android phones being shipped with preinstalled malware at the firmware level. This malicious software generates fraudulent ad revenue and transforms infected devices into residential proxies, leaving victims scattered across 150 countries worldwide. The malicious actors managed to compromise the supply chain of multiple smartphone manufacturers, including Doogee S200 X, Doogee Fire 3 Max, and Cubot KINGKONG X, and even impersonated well-known brands such as Samsung and Apple.

These devices, primarily using MediaTek chipsets, tamper with applications, grant themselves higher privileges, and execute remote code attacks without the user's knowledge. The malware is disguised as various legitimate-looking apps, such as weather apps, file managers, app lockers, OCR tools, and audio editors, all of which create invisible overlays on the screen to register fraudulent ad views.

This generates profit for the malicious party while the user remains unaware. The true extent of the compromised devices and the financial damage caused remains undisclosed. The malware operates without registering fraudulent impressions and clicks, while the real revenue generator lies in the dropped cover apps, including weather, app-lock, note, and OCR applications, which load genuine ads through a legitimate ad SDK.

One uncovered application contained a TCP proxy element that registered compromised phones with a remote command server, enabling attackers to forward traffic and create residential proxy services for illicit activities. While many of these malicious apps can be removed manually via uninstallation or by using Android Debug Bridge (ADB) for firmware-level cleanup, Bitdefender advises consumers to exercise caution when purchasing budget Android phones from brands with questionable reputations.