Budget Android Phones Found Shipping with Preinstalled Malware
Bitdefender researchers found that some budget Android phones from brands like Doogee and Cubot were shipped with firmware-level malware. The malware generated fraudulent ad revenue and turned infected devices into residential proxies. Thousands of victims across 150 countries were affected, and cleanup often requires firmware-level remediation.
Bitdefender traced the issue to a supply-chain compromise affecting several budget Android makers. Named models include Doogee S200 X, Doogee Fire 3 Max, and Cubot KINGKONG X, plus counterfeit Samsung and Apple devices, generally using MediaTek chips. The tampering let attackers alter apps, gain elevated permissions, and run remote code.
The campaign reportedly reached thousands of users in roughly 150 countries, with notable clusters in Mexico, France, Italy, the U.S., Germany, Brazil, and Spain. Investigators found 32 malicious apps posing as weather, file-manager, app-locker, OCR, and audio-editing tools; invisible overlays logged ad impressions through a legitimate SDK. Some devices also became residential proxies.
Consumers who buy inexpensive or counterfeit Android handsets may face hard-to-remove infections, unexpected data use, and privacy risks if devices act as proxies. Because cleanup can require firmware-level fixes, ordinary users could struggle to secure affected phones, potentially eroding trust in budget brands and third-party resellers. Advertisers and ad networks may also bear costs from fake impressions, while affected users across many countries might remain unaware until performance or security problems appear.