Cheap Android phones shipping with preinstalled malware, researchers warn

Malware embedded in firmware before shipment

According to TechRadar, security researchers at Bitdefender have identified a supply chain compromise affecting budget and rugged Android phones from Chinese manufacturers Doogee and Cubot. The malware is embedded in the devices’ firmware before they reach customers, making it difficult to detect or remove without technical intervention.

The affected models include devices like the Doogee S200 X, Doogee Fire 3 Max, and Cubot KINGKONG X. These phones are marketed as affordable, durable options but are reportedly shipping with malicious code preinstalled.

Fraudulent ad revenue and residential proxies

The malware is designed to generate fraudulent ad revenue by displaying hidden ads and interacting with ad networks without the user’s knowledge. Bitdefender identified 32 malicious apps, including fake weather apps, file managers, and OCR tools, all of which contribute to this scheme.

In addition to ad fraud, the malware converts infected devices into residential proxies. One malicious app contained a TCP proxy element that registers compromised phones with a remote command server, allowing attackers to route traffic through the devices and create a residential proxy network.

Global impact and removal challenges

Victims of the malware span 150 countries, with the highest concentrations in Mexico, France, Italy, the U.S., Germany, Brazil, and Spain. Removing the malware is not straightforward, as it requires firmware-level cleanup or the use of technical tools like Android Debug Bridge (ADB), which may be beyond the capabilities of most users.

Bitdefender also found more than a dozen apps on the Google Play Store that shared the same fraudulent advertising code and infrastructure, suggesting the malware’s reach extends beyond preinstalled apps.

How the malware operates

The malware exploits devices running MediaTek chipsets, allowing attackers to tamper with applications, elevate privileges, and execute remote code execution (RCE) attacks without the user’s knowledge. This level of access enables the malware to persist even after factory resets, as it is embedded in the firmware.

Bitdefender’s findings highlight the risks of supply chain compromises, where malware is introduced before devices reach end users. The report suggests that avoiding brands with questionable reputations may be the most effective way to mitigate such risks.

Broader context of supply chain risks

Supply chain compromises are not new but are increasingly exploited by threat actors to distribute malware at scale. Preinstalled malware in firmware is particularly difficult to detect and remove, as it operates at a deeper level than typical app-based threats.

Budget devices from lesser-known manufacturers may carry higher security risks, as their supply chains and quality control processes may not be as rigorous as those of established brands like Samsung or Google.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This story underscores a critical blind spot for founders and operators: hardware supply chains can be a hidden vector for malware. For startups building or selling devices, the risks of preinstalled malware go beyond reputational damage—they can expose customers to fraud, surveillance, or further cyberattacks. The fact that fraudulent ad revenue schemes are now extending into firmware suggests that threat actors are evolving faster than detection mechanisms, especially in budget segments of the market.

For founders, this is a reminder to vet suppliers rigorously, especially when sourcing hardware from lesser-known manufacturers. It also highlights the importance of transparency in the supply chain, as customers and regulators may increasingly demand proof that devices are free from hidden malware. Finally, the emergence of residential proxy networks from infected devices shows how easily consumer tech can be weaponized, creating broader security risks for the entire internet ecosystem.

Key takeaways

• Supply chain compromises can embed malware at the firmware level, making it difficult for users to detect or remove without technical expertise.
• Fraudulent ad revenue schemes are evolving to exploit preinstalled apps, extending beyond app stores to affect hardware supply chains.
• Residential proxy networks created from infected devices pose broader risks, including enabling further cybercrime.
• Founders in the smartphone or app ecosystem should audit their supply chains and third-party dependencies to mitigate hidden vulnerabilities.
• Budget devices from lesser-known brands may carry higher security risks, requiring extra due diligence before adoption or resale.

FAQ

Which phone models are affected by this malware?

The affected models include budget and rugged Android phones from Doogee and Cubot, such as the Doogee S200 X, Doogee Fire 3 Max, and Cubot KINGKONG X. These devices are shipping with preinstalled malware embedded in their firmware.

How can users remove the malware from infected devices?

Removing the malware requires either firmware-level cleanup or the use of technical tools like Android Debug Bridge (ADB). These methods are not accessible to most users, making removal difficult without professional assistance.

Are apps on the Google Play Store also involved in this scheme?

Yes, Bitdefender found more than a dozen apps on the Google Play Store that contained the same fraudulent advertising code and infrastructure as the preinstalled malware. This suggests the scheme extends beyond firmware-based infections.

Related on Lazyfounder

• Bitdefender
• Google
• More technology news
• AI-driven cybercrime forces small businesses to prioritize cybersecurity