Pre-installed Malware Found in Smartphones Sold on Major Marketplaces

Security researchers from Bitdefender have identified a global campaign involving smartphones pre-installed with malicious software at the manufacturing stage. The malware is integrated into the firmware, making it impossible to remove via standard Android tools as it mimics system software.

The affected devices primarily use MediaTek processors. Identified models include the Doogee S200 X and Cubot KINGKONG X, both of which are available on major Russian marketplaces such as Ozon, Wildberries, and Yandex Market.

The malicious software connects devices to a botnet for traffic proxying and DDoS attacks. It also generates unauthorized ad clicks in the background and can download additional malware, granting it access to SMS, notifications, and other system functions.

The campaign spans 150 countries, with high infection rates in Mexico, France, Italy, the US, Germany, Brazil, Spain, the UK, Canada, Romania, Poland, and Thailand. Experts also noted counterfeit devices mimicking Honor and Samsung models containing similar threats.