Cybersecurity company Bitdefender has reported that some Android phones were infected with malware before reaching the user. According to the research, attackers infiltrated the devices' supply chain and embedded malicious code at the system software level.
The findings point to models from certain China-based manufacturers, particularly in the affordable and rugged phone segment. Affected devices include the Doogee S200 X, Doogee Fire 3 Max, and Cubot KINGKONG X models. The research also noted that similar malware was found on fake phones imitating well-known brands.
According to Bitdefender's assessment, the case is not limited to a specific country. It was reported that the malware reached thousands of devices in more than 150 countries, including the USA, France, Italy, Germany, Spain, Mexico, and Brazil.
SUSPICION OF SUPPLY CHAIN INFILTRATION
Researchers state that the malicious code, mostly seen in devices with MediaTek processors, can obtain high-level privileges on the system. This opens the door for attackers to interfere with installed applications and execute remote code without user permission.
It is emphasized that the attack is different from a classic "malicious app installation" case. Because the malicious code is embedded in the devices' system software, the threat can be active as soon as the phone is turned on for the first time. For this reason, simply uninstalling a suspicious application may not always be enough to clean the device.
Bitdefender announced that the malware infrastructure downloads different applications in the second stage, and 32 malicious applications were detected in this context. It was noted that these applications can appear as ordinary tools such as weather apps, file managers, app lockers, or audio editors.
A significant portion of the detected activity consists of ad fraud. Malicious applications can create fake impressions by running ads through windows invisible to the user. Thus, even if the phone owner does not perform any action, their device can be used to generate revenue in the background.
The research also stated that the risk is not limited to this. It was stated that some applications communicate with command and control servers belonging to attackers, and that compromised phones can be used as proxies, allowing network traffic to be routed through the victims' devices.
According to experts, such cases increase the importance of supply chain auditing in mobile device security. Malware embedded at the system level cannot always be easily removed with the usual precautions users can take after purchasing the device.
News Source: 12punto
