Preinstalled Android Adware in Low-Cost Phones Enabled Persistent Malware

Security researchers reported that a significant share of Android infections stemmed from malware and adware embedded in the system partition or shipped in device firmware, particularly on low-cost smartphones and tablets. Because these components reside in protected system areas, they are difficult to remove without reflashing the device and can survive normal cleanup efforts. The report said 14.8% of users hit by malware or adware over the prior year had infections in the system partition, with prevalence reaching 27% for some budget vendors.

Researchers identified two main infection paths: malware that gains root access and installs itself into system directories, and ad-related code inserted into firmware before devices are sold. Threats observed included Triada, Lezok, Agent.pe, Sivu.c, Plague.f, Agent.pac, Penguin.e, Necro.d, Facmod.a, Guerrilla.i, Virtualinst.c, and Secretad.c, which were linked to silent app installation, intrusive advertising, code downloading, and remote control capabilities. The report also highlighted adware-like behavior in some Meizu apps and the widespread presence of the /bin/fotabinder binary, which could download and execute code from remote servers, underscoring supply-chain security risks in budget Android devices.