Malware
Some Cheap Android Phones Are Shipping with Malware Built In, Experts Warn
Security researchers say thousands of low-cost Android phones may come with hidden malware that can steal data and make money for criminals. Removing it is difficult, and the safest option may be to avoid untrusted brands.
Ross GrantUpdated 3 min read
The short version
Some low-cost Android phones may come with hidden malware already installed. This malware can steal your data, make money for criminals, and is hard to remove. Experts recommend avoiding unknown brands and buying from trusted retailers. The claims are based on one report and have not been confirmed by phone makers or authorities.
By the numbers
- 32malicious apps found pre-installed on affected phonesTechRadar
- 150countries where affected devices were foundTechRadar
- thousandsestimated number of victims, according to BitdefenderTechRadar
What happened?
Security researchers say some cheap Android phones, including brands like Doogee and Cubot, are being shipped with malware already installed. The malware can grant attackers high-level access and turn devices into tools for fraud. Thousands of devices in 150 countries may be affected, according to Bitdefender, but these claims have not been confirmed by vendors or authorities.
What brands and devices are involved?
According to TechRadar (opens in a new tab), security researchers have found that some low-cost Android phones, including brands like Doogee and Cubot, are being shipped with malware already installed. There are also reports of devices pretending to be well-known brands like Samsung and Apple, but using cheaper hardware and software. Most of these devices use MediaTek chipsets, which appear to be a common factor in the infections.
How does the malware work?
Bitdefender, the security company cited in the report, found 32 different malicious apps pre-installed on these phones. These apps pretend to be useful tools, such as weather apps, file managers, app lockers, OCR (optical character recognition) tools, and audio editors. In reality, they create invisible overlays on top of other apps to register fake ad views. This tricks advertising networks into paying for ads that users never actually see, generating profit for the criminals behind the scheme.
One app, an app locker, goes further: it contains a TCP proxy that connects the phone to a remote command server. This allows attackers to use the device as a residential proxy, forwarding internet traffic through it. Criminals can use these proxies for activities like launching distributed denial-of-service (DDoS) attacks, sending spam, or committing wire fraud.
How widespread is the problem?
Bitdefender claims that “thousands” of people have been affected, with compromised devices found in about 150 countries. The highest numbers are reported in Mexico, France, Italy, the United States, Germany, Brazil, and Spain. The actual number of affected devices and the total amount of money stolen are not yet known.
Researchers also found more than a dozen apps with similar malicious code on the Google Play Store. However, these required users to install them manually and grant permissions, which could have made some users suspicious.
What can victims do?
Removing the malware is not straightforward. In many cases, simply uninstalling the app does not work. Some devices require a firmware-level cleanup or disabling the malicious part using Android Debug Bridge (ADB), a tool that is too technical for most users. The researchers say the best solution is to avoid buying devices from brands with a poor reputation, even if they are much cheaper than established brands.
What should buyers look out for?
If you are buying a new Android phone, stick to well-known brands and buy from trusted retailers. Be cautious of devices that are much cheaper than similar models, especially if they claim to be from top brands but are not sold through official channels. Always check reviews and look for signs of tampering or unofficial software. If you suspect your device is infected, seek help from a professional or contact the manufacturer if possible.
What happens next?
At the moment, these claims are based on a single report from TechRadar, citing Bitdefender’s research. There has been no confirmation from the affected brands, Google, or any government agency. If you think you might be affected, keep an eye out for updates from official sources and consider replacing your device if you notice suspicious behaviour.
Claimed vs confirmed
- Unconfirmed
Cheap Android phones are being shipped with malware built in.
Reported by TechRadar citing Bitdefender, but not confirmed by vendors or authorities.
- Unconfirmed
Thousands of people in 150 countries are affected.
Bitdefender claims this, according to TechRadar, but there is no independent confirmation.
The impact
- Money
- The exact financial impact is unknown, but the malware generates profit through ad fraud. If a regulator finds a company responsible, fines under GDPR could reach €20m or 4% of global turnover.
- Reputation
- Brands linked to these devices could face serious trust issues, especially if consumers believe their products are unsafe. Official brands like Samsung and Apple are mentioned as targets of impersonation, not as sources of the malware.
- Customers
- People who buy affected devices risk having their data stolen or their devices used for criminal activity. Removing the malware is difficult, so the safest option is to avoid unknown brands.
Why it matters
People who buy cheap Android phones from lesser-known brands may be at risk of having their data stolen or their devices used for criminal purposes. The malware is hard to remove and could put users' privacy and security at risk.
How does it work?
The malware is installed at the firmware level or as system apps on certain Android phones. It can create invisible overlays to fake ad views, and in some cases, turn the phone into a proxy for criminal activity. Removing it often requires technical steps beyond uninstalling the app.
Key points
- Some cheap Android phones may come with pre-installed malware.
- The malware can fake ad views and turn devices into proxies for criminals.
- Thousands of devices in 150 countries may be affected, according to Bitdefender.
- Removing the malware is difficult and may require technical skills.
- Buyers should stick to trusted brands and retailers.
Sources
TechRadar
Reference
