Doogee, Cubot phones hit by supply chain malware faking ad clicks across 150 nations
Bitdefender reports that malware embedded in the firmware of budget Android devices from brands like Doogee and Cubot has infected thousands of users across 150 countries, generating fraudulent ad revenue.
Key points
- Bitdefender identified supply chain compromises affecting Doogee and Cubot smartphones.
- The malware operates at the firmware level, creating overlays to fake ad impressions.
- Victims span 150 countries, with high concentrations in the US, Mexico, and Europe.
Bitdefender researchers have identified a significant supply chain compromise affecting multiple manufacturers of budget Android smartphones. According to a report by TechRadar, the security firm found that malware was embedded directly into the device firmware before the phones were shipped to retail stores. This infection method allows the malicious code to persist deep within the system, making it difficult for standard user actions or simple factory resets to remove the threat. The compromise affects devices from Chinese manufacturers Doogee and Cubot, specifically models such as the Doogee S200 X, Doogee Fire 3 Max, and Cubot KINGKONG X.
The risk
The malware functions by creating invisible overlays over legitimate applications, which tricks ad networks into believing that users are viewing advertisements. Bitdefender uncovered 32 distinct malicious apps disguised as common utilities like weather tools, file managers, and audio editors.
These apps generate fraudulent ad clicks and impressions without the user's knowledge or consent, generating illicit revenue for the threat actors. The infected devices also serve as residential proxies, allowing attackers to route their traffic through the compromised phones to mask their true location and identity. This behavior turns the user's device into a tool for further malicious activities.
Who is exposed
The impact of this campaign is global, with Bitdefender reporting victims in approximately 150 countries. The highest concentration of infected devices was found in Mexico, France, Italy, the United States, Germany, Brazil, and Spain. The malware primarily targets devices using MediaTek chipsets, which were exploited to grant the attackers higher privileges and enable remote code execution. In addition to the named brands, the report mentions that counterfeit devices impersonating major brands like Samsung and Apple may also be affected. Thousands of individuals are believed to have purchased these compromised units, though the exact total number of infected devices remains unknown.
Cost and compliance
The primary financial loss stems from the fraudulent ad revenue generated by the invisible overlays. The malware registers an ad as viewed despite the fact that the user never actually saw it, scamming ad networks into thinking the ad was served to thousands of users. Bitdefender noted that the system app itself does not register these fraudulent events, making detection difficult for standard monitoring tools.
There is no information available regarding the total amount of money stolen or the specific compliance violations triggered by this unauthorized data handling and proxy usage. The cleanup process often requires firmware-level remediation, which can be complex for average consumers and may involve reflashing the device software to remove the deeply embedded malicious components.
What should you do?
IT managers and security teams should audit device inventories for any units from Doogee, Cubot, or other unknown budget manufacturers, particularly those using MediaTek chipsets. If such devices are present in the corporate environment, they should be isolated from the network and subjected to rigorous forensic analysis for signs of firmware tampering or unauthorized proxy activity.
Organizations should enforce strict procurement policies that require devices to come from verified, reputable vendors with transparent supply chains. Users who suspect their device is infected should consult the manufacturer for official firmware updates or consider replacing the hardware if no clean image is available.
Background: Remote code execution vulnerabilities
Small businesses face high remote code execution risks due to limited patching resources and complex dependencies. You can mitigate this by enforcing strict input validation, maintaining an accurate IT asset inventory, and requiring vendors to demonstrate automated security regression testing for all updates.
Read the full guide: Remote Code Execution Risks and Protection for Small Businesses
What to do and how to stay safe: Bitdefender
- Check your device inventory for phones from Doogee, Cubot, or other unverified budget brands, especially if they use MediaTek processors.
- Monitor network traffic for unusual outbound connections that could indicate the device is being used as a residential proxy.
- Verify that any new hardware purchases come from authorized distributors and have verifiable firmware signatures.
- Watch for unexpected battery drain or data usage, which may signal background processes running malicious overlays.
General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific phone models are affected by this firmware malware?
The report identifies the Doogee S200 X, Doogee Fire 3 Max, and Cubot KINGKONG X as confirmed affected models.
How does the malware generate revenue for the attackers?
It creates invisible overlays over apps to register fake ad views and clicks, tricking ad networks into paying for non-existent impressions.
Is there a patch available to remove this malware?
The source material does not mention a specific software patch; it notes that cleanup often requires firmware-level remediation.
