BITDEFENDER has traced a supply-chain–level campaign in which low-cost Android handsets, built on MediaTek platforms, come preinstalled with malware that can covertly install or uninstall apps, harvest device and app data, and load remote payloads. The dropper—named com.android.system[.]lite by researchers—runs with system privileges, enabling it to extend its own permissions to accessibility services, notifications and SMS, and to load additional code from an external server.
The primary aims appear to be ad fraud and the deployment of partner apps that incorporate proxyware and further code execution capabilities. The operators can also grant permissions to any Android package, effectively turning devices into botnet-friendly assets and residential proxies through which ads are loaded and monetised.
Bitdefender’s investigation identified 13 Google Play apps that communicate with the malware’s control servers, indicating the scheme extends beyond preinstalled firmware to apps distributed via the Play ecosystem. Notably, the malware reportedly disables the Google Play Store prior to installing a payload app and re-enables it afterwards, a tactic likely designed to bypass Play Protect safeguards.
Infected devices have been found across multiple countries, with the majority in Mexico, followed by France, Italy, the U.S., and several others including the U.K. and Canada. The campaign’s preinstalled nature points to supply-chain compromise, and researchers say remediation cannot simply consist of uninstalling the software, since the root component resides in the system partition. The public health fix, they say, lies with device vendors and the marketplaces that ship affected firmware.