Bitdefender Reports Firmware Malware on Budget Android Phones

Security researchers at Bitdefender say malware was installed in the firmware of some budget Android phones before they shipped to stores. The company says an unidentified threat actor compromised the supply chains of multiple smartphone makers.

Devices named in the report include the Doogee S200 X, Doogee Fire 3 Max and Cubot KINGKONG X. Bitdefender says the affected phones use MediaTek chipsets and that the malware can tamper with apps, gain higher privileges and run code remotely. The report also mentions counterfeit devices made to resemble Samsung and Apple products.

Bitdefender says it found 32 malicious apps, including weather, file manager, app locker, OCR and audio editing apps. They can place invisible overlays on other apps and register fraudulent ad views. Researchers also found a TCP proxy component in one app locker, which could route traffic through infected phones.

The company estimates that “thousands” of people across about 150 countries were affected, with the highest concentrations reported in Mexico, France, Italy, the United States, Germany, Brazil and Spain. The exact number of compromised devices and the amount of money involved are unknown.

Bitdefender says some devices may need firmware-level cleanup or disabling of a malicious component through Android Debug Bridge (ADB). It also found more than a dozen Google Play apps with the same advertising code and communications infrastructure; those required users to install them manually and grant permissions.