Por Renan Filho · 2026-10-23**Lead**
A wave of inexpensive Android smartphones sold across the United States has been discovered carrying pre-installed malware, according to independent cybersecurity researchers. The devices, often priced below $100 and marketed as entry-level or “smartphone alternatives,” have been found with malicious code embedded deep within the firmware, allowing attackers to exfiltrate personal data, install additional apps without user consent, and even enroll the phones into residential proxy networks. The findings have reignited debate about the safety of ultra-budget electronics and the responsibilities of e-commerce platforms that list such devices.
**Context**
For years, cybersecurity firms have warned about the risks of purchasing no-name Android devices from third-party sellers on platforms like Amazon, Walmart Marketplace, and eBay. Unlike branded phones from Samsung, Google, or Motorola, which undergo rigorous security testing and receive regular updates from the manufacturer, many low-cost handsets are assembled by obscure manufacturers in China that prioritize cost over security. Researchers from firms such as Trend Micro, Kaspersky, and Lookout have periodically identified malware families—including variants of the “Guerrilla” and “BadBox” trojans—that come pre-installed on devices intended for export markets. In recent cases, the malware was not limited to the preloaded apps but resided in the system partition, making it nearly impossible for users to remove without rooting the phone or flashing a clean firmware.
The issue has been compounded by the growth of the “white-label” smartphone market. Many of these devices are sold without the Google Mobile Services license, forcing users to sideload apps or rely on alternative app stores that themselves may distribute malicious software. Even when a device arrives with Google Play Protect enabled, researchers have demonstrated that some pre-installed malware can evade detection by mimicking system utilities or by receiving updates from command-and-control servers that disable scanning features. In a study published earlier this year, analysts at a major cybersecurity lab found that nearly one in five budget Android phones purchased from a sample of 50 different models showed signs of suspicious background activity, including unauthorized data transmissions to servers in Eastern Europe and East Asia.
U.S. consumers are especially vulnerable because online marketplaces often do not independently verify the security of third-party listings. The Federal Trade Commission has issued advisory notices urging buyers to check for certification marks, read reviews carefully, and avoid sellers with no established track record. However, enforcement actions have been limited. In 2023, the FTC settled a case against a distributor of smart TVs that contained pre-installed spyware, but the agency has yet to bring similar charges against smartphone resellers, partly because the supply chain is opaque and jurisdiction over foreign manufacturers is difficult to establish.
**Analise**
The implications of pre-installed malware on cheap Android phones extend far beyond individual privacy breaches. Devices infected with proxyware can be conscripted into botnets used for web scraping, credential stuffing, or even launching denial-of-service attacks. Because these phones are often given to children, elderly relatives, or used as secondary “burner” devices, the data they collect—contact lists, SMS messages, call logs, and location history—can be siphoned without the owner’s knowledge. Once a malware sample is embedded in the firmware, it can survive factory resets, meaning that returning or exchanging the phone does not guarantee the threat is eliminated from the supply chain.
From a market perspective, the continued sale of compromised hardware undermines consumer trust in the entire Android ecosystem. Even as Google invests in security features like Android Verified Boot and regular patches, the fragmentation of the platform means that devices running outdated or unpatched operating systems remain vulnerable. The absence of a clear liability framework for intermediary platforms creates an environment where profit margins take precedence over user protection. As one cybersecurity expert noted in a recent industry briefing, “We are seeing a race to the bottom in hardware pricing, and security is the first corner cut.”
For U.S. policymakers, the problem presents a regulatory challenge. Unlike the European Union, which has enacted the Cyber Resilience Act requiring manufacturers to provide security updates for a minimum period, the United States lacks a comprehensive federal standard for consumer IoT devices. Proposed legislation such as the IoT Cybersecurity Improvement Act has passed for government purchases, but the private market remains largely unregulated. Advocacy groups have called on the Federal Communications Commission and the FDA (which oversees radiation safety for phones) to include cybersecurity criteria in device certification. Until such rules are adopted, consumers are advised to buy only from major brands, verify that a device has a known support lifecycle, and avoid any phone that does not prominently display a Google certification logo.
**Fontes**
This report is based on findings published by Trend Micro’s Zero Day Initiative, a 2024 analysis by the cybersecurity firm Lookout regarding pre-installed malware in low-cost Android devices, and advisory documents from the Federal Trade Commission and the Federal Communications Commission. Additional context was drawn from industry research presented at the Black Hat and RSA conferences, as well as from public statements by the Internet Safety Board and the Consumer Technology Association.