Buying a brand-new Android phone should mean starting fresh. But security researchers have uncovered a nasty catch with some budget devices. They may arrive with malware already baked into their firmware, before you even take them out of the box.
Researchers at cybersecurity firm Bitdefender found evidence that an unidentified threat actor had compromised the supply chain for multiple smartphone models, planting malicious software deep inside the devices. The infected phones could secretly generate fraudulent advertising revenue and, in some cases, turn into residential proxies that criminals can use to route their internet traffic through someone else’s device.
The malware is getting in before you buy the phone
Bitdefender identified affected devices including the Doogee S200 X, Doogee Fire 3 Max and Cubot KINGKONG X. These are budget-oriented, rugged Android phones, often marketed to people who want a durable device without paying flagship prices.
Researchers also reported counterfeit devices designed to imitate Samsung and Apple products. The affected devices used MediaTek chipsets, and the compromise allowed attackers to tamper with applications, gain elevated privileges and potentially execute commands remotely without the owner’s knowledge.
This isn’t necessarily a case of someone downloading a dodgy app after buying a phone. The malware was reportedly introduced at the firmware level during the supply chain process, meaning a device could be compromised before it reached a retailer. According to Bitdefender, it had identified thousands of victims across roughly 150 countries. Mexico, France, Italy, the United States, Germany, Brazil and Spain were among the countries with the highest concentrations of affected users.
An affected phone could be making money for criminals while its user scrolls
Bitdefender uncovered 32 malicious apps associated with the operation. They masqueraded as everyday utilities, including weather apps, file managers, app lockers, optical character recognition (OCR) tools and audio editors. For their trick, the apps could create invisible overlays on top of other apps and load advertisements in a way that made ad networks register impressions, even when the user never actually saw the ads.
The researchers said the revenue operation relied on the disguised apps, which loaded legitimate ads through an advertising software development kit. The setup made the activity look more like ordinary advertising traffic than an obvious attack.
Exactly how many devices were affected by this scheme, or how much money the operation generated, remains unclear.
Some infected phones could become criminal internet middlemen
The fake advertising is bad enough, but Bitdefender found another capability that raises the stakes. One of the uncovered app-locking applications contained a TCP proxy component that could register a compromised phone with a remote command server. Once connected, attackers could route internet traffic through the device, effectively turning it into a residential proxy. Residential proxies route traffic through ordinary consumer internet connections rather than obvious data-center servers. That can make online activity harder to distinguish from traffic coming from a regular household.
Criminals can abuse such infrastructure for activities including spam campaigns, fraud and distributed denial-of-service (DDoS) attacks. The phone owner may have no idea their device is being used this way.
Bitdefender also found more than a dozen apps on Google Play containing the same fraudulent advertising code and communication infrastructure. Unlike the firmware-level infections, these apps required manual installation and users had to grant requested permissions. That extra step may give people a chance to notice something suspicious. Still, an app appearing in an official store isn’t, by itself, a guarantee that it’s safe.
Uninstalling the app might not be enough
If the malicious component is integrated deeply enough into a device’s system software, deleting the app responsible for displaying ads may leave the underlying infection untouched. According to Bitdefender, some affected devices require firmware-level remediation, while another possible route involves disabling the malicious component through Android Debug Bridge (ADB), a tool typically used by developers and technically experienced users.
Neither option is especially convenient for someone who simply bought a phone to make calls, use WhatsApp and watch videos. A factory reset may not solve the problem if the compromised component remains in the firmware. The appropriate fix depends on where the malware resides and whether the manufacturer can provide a trustworthy, clean firmware update.
Budget Android phones aren’t inherently unsafe, as a low price does not automatically mean a device is compromised. The issue is about whether the manufacturer has reliable control over its supply chain, verifies the software installed on its devices and continues to provide security updates. That can be difficult for buyers to assess, especially when unfamiliar brands and counterfeit devices compete on price and specifications. A phone can have a huge battery, a rugged case and an impressive-looking feature list while offering little transparency about the software running underneath.
As a buyer, you might want to research the exact model and manufacturer before paying. It is also safer to stick to reputable sellers and check whether the company provides regular security updates. If you already own a potentially affected device, look for guidance from the manufacturer or Bitdefender rather than assuming a factory reset will remove the infection.
Sources: Tech Radar, Bitdefender