Bitdefender Identifies Firmware-Level Malware in Budget Android Phones From Supply Chain Compromise

Security researchers at Bitdefender reported that budget Android phones from manufacturers including Doogee and Cubot are being shipped with firmware-level malware already installed. The threat actor compromised the production supply chain, embedding malicious code into the devices before they were distributed to stores or customers.

The malware operates at a deep system level, allowing attackers to tamper with applications, grant themselves elevated privileges, and perform remote code execution. According to Bitdefender, this supply chain compromise means the infection is present in the device’s core software, making it difficult for users to detect or remove without specialized remediation.

Technical Details and Malware Behavior

Bitdefender identified 32 distinct malicious applications disguised as legitimate tools such as weather apps, file managers, OCR utilities, and audio editors. These apps create invisible overlays on the screen to register ad views that the user never actually sees. This mechanism generates fraudulent ad revenue for the attackers by tricking ad networks into believing impressions were served to real users.

The compromised devices primarily use MediaTek chipsets. The infection method allowed the attackers to bypass standard security controls and execute code remotely. Bitdefender noted that the system app itself does not register the fraudulent impressions, meaning the malicious activity occurs outside the normal visibility of standard application monitoring.

Global Impact and Affected Brands

The affected hardware includes specific models such as the Doogee S200 X, Doogee Fire 3 Max, and Cubot KINGKONG X. These are budget, rugged Android phones produced by Chinese manufacturers. The report also mentions that counterfeit devices impersonating Samsung and Apple products were part of the compromised batch, indicating a broad scope of supply chain infiltration.

Bitdefender stated that thousands of victims have been identified across approximately 150 countries. The highest concentration of infected devices was found in Mexico, France, Italy, the United States, Germany, Brazil, and Spain. The malware also turns the infected phones into residential proxies, which can be used by attackers for various illicit activities without the owner's knowledge.

What should you do?

Users who purchased budget Android phones from the mentioned brands or unverified retailers should exercise caution. Since the malware is embedded in the firmware, standard antivirus scans may not be sufficient to detect or remove it. Owners of the specific models listed should check for any official firmware updates from the manufacturers that address security vulnerabilities.

What to do and how to stay safe: Bitdefender

• Verify the origin of your Android device, especially if it is a budget model from brands like Doogee or Cubot.
• Check for and install any available firmware updates from the device manufacturer to patch known vulnerabilities.
• Monitor for unusual battery drain or data usage, which may indicate background proxy or ad-clicking activity.
• Avoid installing unofficial apps and be wary of devices that appear to be counterfeit versions of major brands.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific phone models are affected by this firmware malware?

The Doogee S200 X, Doogee Fire 3 Max, and Cubot KINGKONG X were explicitly named, along with counterfeit Samsung and Apple devices.

How did the malware get onto these phones?

The threat actor compromised the supply chain, embedding the malware into the firmware level before the devices were shipped to customers.

What does the malware do on the infected devices?

It generates fraudulent ad revenue by simulating ad views and turns the phones into residential proxies for remote use.