Are budget Android phones arriving with pre-installed firmware malware?

The short version

• Security firm Bitdefender detected a supply chain attack targeting budget smartphone manufacturers.
• Affected brands include Doogee and Cubot, with devices shipped globally before detection.
• The malware operates at the firmware level, making standard removal methods ineffective.

The details

According to TechRadar, security researchers at Bitdefender discovered that threat actors compromised the production lines of several smartphone manufacturers. This supply chain breach allowed attackers to embed malware directly into the firmware of devices before they reached retail stores. The affected hardware includes specific models such as the Doogee S200 X, Doogee Fire 3 Max, and Cubot KINGKONG X. These brands are known for producing rugged, budget-friendly Android phones primarily manufactured in China. The contamination happened at a stage where the devices were sealed and new, meaning customers received infected units without any visible signs of tampering during purchase.

The malware utilises MediaTek chipsets found in these devices to gain elevated privileges. Attackers can tamper with applications and perform remote code execution without the user’s knowledge. Bitdefender uncovered 32 distinct malicious apps disguised as legitimate utilities like weather tools, file managers, and audio editors. These applications create invisible overlays on other apps to register fake ad views. This activity generates fraudulent revenue for the threat actors by tricking ad networks into paying for impressions that never occurred on screen.

The context

The scope of this incident is significant, with victims reported across 150 countries. TechRadar notes that the highest concentration of compromised devices was found in Mexico, France, Italy, the United States, Germany, Brazil, and Spain. Bitdefender estimates that thousands of individuals have been affected by this widespread distribution. The report also mentions that some counterfeit devices impersonating major brands like Samsung and Apple were involved in similar schemes. Because the malware is rooted in the firmware, standard troubleshooting steps often fail to remove the threat. Cleanup typically requires deep firmware-level remediation, which may not be possible for all users.

Next steps

Organisations should assess their device procurement policies, particularly for budget hardware used in field operations. Security teams need to verify the integrity of device firmware during onboarding processes. Monitoring for unusual network traffic patterns associated with residential proxies is advisable. Users of affected brands should seek manufacturer guidance on firmware updates or replacement options.

Background: Threat actors

Threat actors are individuals or groups who initiate cyber attacks. They range from lone hackers to state-sponsored organisations. Understanding their motives helps you predict behaviour. You must monitor for anomalies, not just known signatures, to detect their presence before data exfiltration occurs.

Read the full guide: What Is Threat Actors: Definitions, Tactics and Detection Strategies

What to do and how to stay safe: Bitdefender

• Verify the firmware version of all new Android devices against known good hashes from the manufacturer.
• Monitor network logs for unexpected outbound connections that resemble proxy traffic or ad fraud signals.
• Avoid installing unofficial or third-party apps on devices that show signs of system-level tampering.
• Check vendor advisories for firmware updates once the vendor provides an update to address the supply chain flaw.

Step-by-step guide: Firmware Malware Prevention Checklist for Persistent Threats

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific phone models are affected by this firmware malware?

The Doogee S200 X, Doogee Fire 3 Max, and Cubot KINGKONG X are explicitly named, along with other budget devices from these manufacturers.

How does the malware generate revenue for the attackers?

It creates invisible overlays on apps to register fake ad views, tricking ad networks into paying for impressions users never saw.

Is there a simple way to remove this malware?

No, because it is embedded in the firmware, cleanup often requires complex firmware-level remediation rather than standard app deletion.