Bitdefender finds firmware malware preinstalled on budget Android phones
Malicious code shipped at the firmware level on MediaTek-based Doogee and Cubot rugged phones, affecting thousands of victims in about 150 countries.
Bitdefender researchers said an unidentified threat actor compromised the supply chain of multiple smartphone manufacturers and preinstalled malware at the firmware level before the devices reached stores. Affected budget rugged Android models named in the research include the Doogee S200 X, the Doogee Fire 3 Max and the Cubot KINGKONG X.
The compromised devices run on MediaTek chipsets, which Bitdefender says allowed the attackers to tamper with applications, gain higher privileges and carry out remote code execution.
According to Bitdefender, thousands of victims are spread across roughly 150 countries. The highest concentrations were recorded in Mexico, France, Italy, the United States, Germany, Brazil and Spain.
The company uncovered 32 malicious apps, among them fake weather apps, file managers, app lockers, OCR tools and audio editors. These apps create invisible overlays to register fraudulent ad views.
One app locker contained a TCP proxy element that registered compromised phones with a remote command server, effectively creating a residential proxy service. More than a dozen apps carrying the same fraudulent advertising code were also found on the Google Play Store, though those require manual installation and permissions granted by the user.
Removing the malware often means firmware-level cleanup or disabling the malicious component through Android Debug Bridge.
Quick answers
Which phone models were affected?
Bitdefender named the Doogee S200 X, Doogee Fire 3 Max and Cubot KINGKONG X among the budget rugged Android models shipped with firmware-level malware.
How many victims and where are they?
Bitdefender says thousands of victims are spread across about 150 countries, with the highest concentrations in Mexico, France, Italy, the United States, Germany, Brazil and Spain.
Can the malware be removed?
Removal often requires firmware-level cleanup or disabling the malicious component via Android Debug Bridge.