Key points
- Bitdefender identified firmware-level malware in budget Android phones from Doogee and Cubot.
- The malware generated fraudulent ad revenue and turned devices into residential proxies.
- Victims were found across 150 countries, with high concentrations in the US, Mexico, and Europe.
Organizations should verify the integrity of budget Android devices before deploying them, as Bitdefender reported finding preinstalled firmware malware in phones from manufacturers like Doogee and Cubot. This supply chain compromise affects devices before they reach customers, creating immediate security risks for any organization that purchases such hardware for employees or operations.
In plain English
The malware was embedded deep within the phone’s firmware, meaning it operates at a system level that is difficult to remove. According to Bitdefender, the threat actor compromised the production process, adding malicious code before the devices were shipped to stores. This allows the attackers to tamper with applications, grant themselves higher privileges, and execute remote code without the user’s knowledge.
The background
Bitdefender uncovered 32 malicious apps disguised as common utilities like weather apps, file managers, and audio editors. These apps create invisible overlays to register fake ad views, generating fraudulent revenue for the attackers. The infected devices, which often use MediaTek chipsets, were also turned into residential proxies. Victims spanned 150 countries, with significant numbers in the US, Mexico, France, Italy, Germany, Brazil, and Spain.
What changes now
The presence of this malware suggests that budget device supply chains may be vulnerable to compromise. Because the infection is at the firmware level, standard app removal is often ineffective. Organizations relying on low-cost hardware for field operations or remote work need to assess whether their procurement processes include security validation steps to detect such preinstalled threats before deployment.
What to do and how to stay safe: Bitdefender
- Audit all budget Android devices currently in use for unknown system apps or unusual permission requests.
- Monitor network logs for unexpected outbound traffic that could indicate device usage as a proxy.
- Check for firmware updates from manufacturers, though no fix has been confirmed yet for this specific supply chain issue.
- Avoid purchasing unverified budget phones from unknown retailers until supply chain integrity can be assured.
Step-by-step guide: How Ransomware Works: The Step-by-Step Infection Cycle
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which brands are affected by this firmware malware?
Bitdefender identified Doogee and Cubot devices, including the Doogee S200 X, Doogee Fire 3 Max, and Cubot KINGKONG X.
How does the malware make money?
It creates invisible overlays to register fake ad views, scamming ad networks into paying for impressions that never actually occurred.
Can users remove this malware themselves?
Cleanup often requires firmware-level remediation, as the malware is embedded deep in the system and grants attackers high privileges.
