Preinstalled Malware Found in Low-Cost Android Phones
Budget Android phones shipping with firmware-level malware turn devices into residential proxies and covertly install apps. Here is what to check.
Marisol "Fuse" DelgadoCheap Android handsets are arriving with malicious software baked into the device firmware before they reach a consumer. A Hacker News report details how affected phones silently enroll as residential proxy nodes, covertly install apps, and run background ad fraud without any user action.
The malware is at the firmware layer, not the app layer. That placement matters: a factory reset will not remove it, and Google Play Protect cannot flag it because it ships as part of the signed system image.
What the firmware malware does
Affected firmware enables three distinct capabilities. It enrolls the device as a residential proxy, routing outside traffic through the phone’s data connection without the owner’s knowledge. It can push and install apps without user consent. And it runs background processes that generate fraudulent ad impressions and clicks.
The residential proxy piece carries the most legal exposure. Traffic tied to fraud investigations or illicit activity can trace back to the device and its registered owner.
Why there is no list of affected devices
This is not one manufacturer’s problem. Firmware modifications at this level typically happen in the contract manufacturing tier, not the brand tier. A device sold under an unfamiliar label may share firmware with dozens of similar “brands” from the same supplier. No published list of confirmed SKUs exists at this stage.
What to check and what to do
For individuals using budget Android hardware from unfamiliar vendors: go to Settings > Apps and enable “Show system apps.” Look for anything with no obvious purpose that you did not install, paying attention to apps with permissions over contacts, location, or network management.
If you have adb available, adb shell pm list packages -3 lists all third-party packages on the device. Compare the output against what you knowingly installed. Anything unrecognized is worth investigating.
A factory reset will not clean a firmware-level infection. The only remediation is flashing a verified stock image from the original manufacturer, if one exists. If that is not an option, replace the device. There is no software patch that fixes a compromised factory image.
For enterprise and MDM environments: block enrollment from unrecognized manufacturers at the policy layer. Audit specific device SKUs before they go out to users. Unexplained outbound proxy traffic from managed mobile devices is an incident indicator, not a network anomaly.
This pattern is not new
Triada, documented in 2023, infected cheap Android phones through a compromised supply chain and ran the same residential proxy and silent-install model. The economics behind this are structural: a contract manufacturer gets paid once per unit, and a proxy network or ad fraud operator pays ongoing. The incentive does not go away on its own.
Related: UNISOC Modem Bug Enables Over-the-Air RCE, CVSS 9.8 | Android Malware Relays NFC Cards, Takes Out Loans | Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 Active
Found this useful? Share it.
