Pre-infected: when the phone ships with the problem

The gap in the app list

An app list shows what has been installed on top of the operating system. It does not show what the manufacturer or a firmware supplier built into it. A system app signed with the platform key can hold powers an ordinary app cannot, and one baked into the system partition cannot be removed by the owner. If the malicious part is there, the app list is a view of the wrong layer.

Case one: a system app on low-cost phones

Bitdefender Labs, on 8 October 2026, described a platform-signed system app in the firmware of low-cost phones. According to Bitdefender, it cannot be uninstalled and can install and remove apps and grant permissions silently. It temporarily disables the Play Store and then forges the field that records where an app came from, so that a later install looks as if it came from Google Play, although it lacks the store’s signature data. It makes money through ad fraud, click fraud and residential-proxy relays[S1].

Bitdefender saw thousands of affected devices over about two years, in many countries; the largest groups were in Europe and the Americas[S1]. Some of the devices were counterfeit models using flagship names[S1]. Privacy Guides summarized the report on 20 October[S2].

Bitdefender maps the firmware certificates to a hardware vendor, and says plainly that this is a supply-chain link, not proof of authorship or knowledge. It links the infrastructure to earlier malware families tracked by other researchers[S1]. We name no brand or vendor here. Bitdefender advises hunting the shared core of the code rather than package names, which change[S1].

Case two: a backdoor in tablet firmware

Kaspersky described Keenadu, a loader built into a core system library inside signed firmware; some of it reached devices through firmware updates over the air. It runs inside the process from which every app starts, so every app gets a copy, and a server part runs in a system service. The loader exits if certain conditions, including the presence of Google services and a Chinese locale setting, are not met, and the control server withholds its payloads for about two and a half months, which delays analysis [S3][S4].

The money again comes from ad fraud and search hijacking, with modules for the Chrome browser, click-fraud and install monetization. Kaspersky also found it in three smart-camera apps on Google Play, since removed. It counted affected users in several countries and linked the family to earlier lineages [S3][S4]. The reports speak of uncertified or little-known tablets; we name none.

Why they are hard to catch

Both reports describe designs that resist inspection. The Keenadu loader exits unless certain conditions are met and its control server holds back payloads for about two and a half months, so an analyst testing a device in a laboratory may see nothing [S3][S4]. Bitdefender describes the Midnight Mimosa app switching the Play Store off for a time, forging the installer field, and toggling accessibility and notification-access grants automatically[S1]. Each of these is a place where a quick look finds a clean device.

Our assessment: what the two cases share

Both cases are about incentives more than espionage. The paid work is fraud at scale, not a targeted look at one person, and the owner is a resource rather than a target. That makes the cases different in kind from the spyware stories elsewhere in this series, and it is why we describe them without attributing intent to anyone.

The shared lesson is about evidence. In both cases the thing that mattered was below the app list: a library in the system partition in one, a platform-signed system app and a forged install record in the other. We read that as a reason to examine the install record and the system layer together, not to trust a clean app list.

Neither report claims that any brand or signing company knew what was shipped. Bitdefender says so directly[S1]. Honest reporting of this class has to hold two facts at once: the code was in the product, and who put it there is not established.

Google’s own figures show the scale of the app-store side of the problem: in 2025 Play Protect identified more than 27 million new malicious apps outside Google Play[S5]. That is a different problem, because those are apps people installed, but it explains why the shipped-with-it cases are hard to see by contrast.

Money, not surveillance

Counterfeit phones add a further layer, since the label on the box and the hardware inside may disagree[S1]. Buying advice from these reports is limited and we keep to it: the reported cases cluster in low-cost, uncertified or counterfeit hardware. Neither report says that a particular brand, price band or retail channel is safe.

Two cautions apply to every number above. Both come from security vendors’ telemetry, which sees only that vendor’s customers, so the true count of affected devices is unknown and larger. And Bitdefender updated its post a day after publishing it, a reminder that early reports of this kind are revised as more is learned[S1].

What the Lab is watching

We are watching whether the vendors of the affected firmware respond, whether the platform owner publishes any change to certification, and whether further analysis ties the two cases to earlier families. We are also watching for reports of the same pattern on streaming boxes and projectors, which are not covered by either source.

What this means for examiners

For a phone’s owner: if a budget device behaves oddly, with apps appearing, settings changing or heavy background data, the cause may lie below the app list, and the manufacturer’s own support route is the first stop. Keep the receipt and the model details, since they help a later examiner establish what was shipped. Photograph the box labels, the model and build numbers in settings, and the date of the first startup, before anything is reset.

For examiners: record how each app was installed and compare the claimed source with its signature data; note system apps and permissions together; where firmware is in question, compare system files against the manufacturer’s known-good build.

How it reaches a phone and what it leaves: propagation is the supply chain, not the owner; the format is firmware or a system app; traces are install records, system files, permission grants and background network sessions; and these may persist, since the owner cannot remove them.