Ethical Hacking News
Low-cost Android smartphones are being shipped with preinstalled malware that can turn them into residential proxies, allowing hackers to conduct ad fraud, silent installations or removals of partner apps, and more. According to Bitdefender, the malicious software is designed to generate revenue, with the operators carrying out ad and click fraud, collecting device and installed-app information, and turning infected devices into residential-proxy relay nodes. The preinstalled nature of the malware suggests a compromise of the device supply chain, and the fact that the malware has been detected on devices with firmware signed using certificates attributed to Shenzhen Zediel Co., Ltd, a Chinese Android device manufacturer, highlights the need for increased vigilance and cooperation between vendors, marketplaces, and consumers to prevent such threats.
Low-cost Android smartphones have been shipped with preinstalled malicious software that can be used for various types of cybercrime. The malicious software, "com.android.system.lite," runs with system-level privileges and can install or uninstall apps at will. The scheme generates revenue by carrying out ad and click fraud, collecting device and installed-app information, and turning devices into residential-proxy relay nodes. The malware has been detected on devices with firmware signed by a Chinese Android device manufacturer, but it's unclear if the manufacturer was involved. The preinstalled nature of the malware suggests a compromise of the device supply chain. The threat of preinstalled Android malware is a growing concern that requires increased vigilance and cooperation between vendors, marketplaces, and consumers.
Low-cost Android smartphones have been found to be shipped with preinstalled malicious software that allows bad actors to conduct various types of cybercrime. This malicious software, which is baked into the device firmware, can turn the devices into residential proxies, allowing hackers to use them to conduct ad fraud, silent installations or removals of partner apps, and more.
The malicious software, which has been identified by Bitdefender as "com.android.system.lite," runs with system-level privileges, allowing it to install or uninstall apps, grant itself additional permissions to accessibility services, notifications, and SMS, and load arbitrary code supplied remotely by the operators. This makes it possible for hackers to install or uninstall apps at will, tuning each device to their needs, including making them part of large botnets.
The scheme is designed to generate revenue, with the operators carrying out ad and click fraud, collecting device and installed-app information, and turning infected devices into residential-proxy relay nodes. The monetization effort is driven by dropper apps that masquerade as seemingly harmless utility apps, which are responsible for loading genuine ads through a legitimate advertising software development kit (SDK). The end goal is to load an invisible window on top of apps that registers the ads being shown.
According to Bitdefender, 13 apps on Google Play communicate with the same servers that control the malware, indicating that the campaign is not limited to preinstalled firmware. The malware has been detected on devices with firmware signed using certificates attributed to Shenzhen Zediel Co., Ltd, a Chinese Android device manufacturer. However, it is unclear at this stage if the certificate owner was involved in or aware of the malware deployment.
The preinstalled nature of the malware suggests a compromise of the device supply chain, with Bitdefender highlighting some level of infrastructure overlaps with Android.Phantom, which was documented by Doctor Web as bundled within modded games and popular apps to conduct click fraud.
The vast majority of the infected devices are located in Mexico, followed by France, Italy, the U.S., Germany, Brazil, Spain, the U.K., Canada, Romania, Poland, and Thailand. This is not the first time a firmware-level backdoor has been observed targeting Android devices. Late last year, Kaspersky disclosed details of another malware codenamed Keenadu that was discovered preinstalled on certain models of tablets running Android to primarily enable ad fraud.
Bitdefender noted that preinstalled malware is a different threat class, and that every user-facing defense assumes the owner is in the loop at installation. However, the malware root component ships in the system partition, making it impossible for the owner to remove it by the normal route. Clearing the device requires firmware-level cleanup or disabling the component over ADB, and neither is realistic for most people who own these phones. The durable fix sits with the vendors and the marketplaces that ship and sell the affected firmware.
In light of these findings, it is clear that the threat of preinstalled Android malware is a growing concern. The malicious software can turn devices into residential proxies, allowing hackers to conduct various types of cybercrime. The preinstalled nature of the malware suggests a compromise of the device supply chain, and the fact that the malware has been detected on devices with firmware signed using certificates attributed to Shenzhen Zediel Co., Ltd, a Chinese Android device manufacturer, highlights the need for increased vigilance and cooperation between vendors, marketplaces, and consumers to prevent such threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Malware-in-the-Midst-The-Growing-Threat-of-Preinstalled-Android-Malware-ehn.shtml
https://thehackernews.com/2026/10/low-cost-android-phones-ship-with.html
https://www.bleepingcomputer.com/news/security/low-cost-android-phones-ship-with-residential-proxy-malware/
Published: Tue Oct 13 03:36:29 2026 by llama3.2 3B Q4_K_M
