Why Do Some Android Phones Come With Malware?

Some Android phones come with malware because of pre-installed apps or firmware that was tampered with before the device reached your hands. This usually happens with cheap, off-brand phones, unlocked bootloaders, or devices from unofficial resellers, where a third party has modified the Android system to include adware, spyware, or other malicious code.

The Supply Chain Problem

Android is an open-source operating system, which means manufacturers can modify it freely. That flexibility is great for customization, but it also creates a security gap. Most legitimate brands like Samsung, Google, or OnePlus build their own secure versions of Android. But smaller, lesser-known manufacturers may use cheaper, older, or already-compromised code as a base. In some cases, a factory or a middleman will add extra apps to a phone to make extra money through advertising or data collection. These apps are already installed when you open the box, so they look like system apps and are very hard to remove.

Another part of the problem is that many budget phones are sold in regions where there is less strict regulation. A phone that is marketed as a “global version” might actually be a device originally meant for one country, then flashed with a different ROM (firmware) by a third party. That flashing process can inject malware without the end user knowing. The phone works fine, but it is silently sending your data or showing unwanted ads.

How Malware Gets Into the Firmware

Malware can be embedded at several points in the supply chain:

At the factory: A manufacturer might install a legitimate but bloated app that later turns out to have a vulnerability, or the factory itself might be compromised.
During shipping: A reseller or distributor might open the box, flash a modified ROM, and reseal it. This is more common than people think, especially with phones sold through third-party marketplaces.
Through system updates: If the phone manufacturer is small or careless, it might push an update that contains malware, either because the developer was hacked or because they intentionally included tracking code.

Once malware is in the firmware, it runs with system-level permissions. That means it can read your messages, access your camera, record your calls, or install more apps without asking. It can also survive a factory reset, because the reset only restores the same compromised firmware.

Why Budget Phones Are More Vulnerable

Budget phones are the most common carriers of pre-installed malware. There are a few reasons for this:

Low profit margins: A $50 phone might not make enough money for the manufacturer, so they look for other revenue streams, like pre-installed adware.
Lack of security patches: Many budget phones never receive regular security updates. Even if the initial firmware is clean, a known vulnerability can be exploited later.
Less rigorous testing: Big brands spend a lot of time and money on security testing. Smaller brands may skip or rush this step.
Older Android versions: Budget phones often ship with an older version of Android that has known security holes. Google has released patches, but the manufacturer never applies them.

This doesn’t mean every cheap phone is infected, but the risk is significantly higher compared to a flagship from a major brand.

How to Tell if Your Phone Has Malware

Signs of pre-installed malware can be subtle. Common symptoms include:

Unexpected pop-up ads, even when you are not using a browser.
Apps you don’t remember installing, especially if you can’t uninstall them.
Battery draining faster than usual.
Data usage spiking for no reason.
Unusual permission requests from system apps.

If you notice any of these, you can check your app list for anything suspicious. Go to Settings > Apps and look for apps with generic names like “System Update,” “Settings,” or “Bluetooth” that you didn’t install. If you can’t disable or uninstall them, they are probably system apps. A factory reset might help, but if the malware is in the firmware, it will come back.

How to Protect Yourself When Buying

The best defense is to buy from a reputable source. Here are some practical steps:

Buy from official stores or authorized resellers. Avoid third-party sellers on marketplaces unless you are sure of their reputation.
Choose well-known brands. Samsung, Google, Motorola, and others have a reputation to protect and are less likely to ship compromised devices.
Check for a warranty and return policy. If the phone has issues, you want to be able to return it.
Look up the model online. Search for “ malware” or “ pre-installed apps” to see if there are known issues.
Unlock the bootloader yourself if you plan to. If you buy a phone that already has an unlocked bootloader or a custom ROM, assume it has been tampered with.

If you already have a phone and are worried, you can use a reputable security app to scan for malware. However, these apps may not catch everything, especially if the malware is deeply embedded.

What to Do if Your Phone Is Infected

If you confirm that your phone has pre-installed malware, you have a few options. First, try to disable the malicious app in Settings. If that doesn’t work, a factory reset might remove it, but only if the malware is not in the firmware. To do a factory reset, go to Settings > System > Reset > Erase all data. Backup your important data first.

If the malware persists after a reset, you need to flash a clean version of the firmware. This is a more advanced process that involves downloading the official ROM from the manufacturer’s website and using a tool like Odin (for Samsung) or Fastboot (for other brands). This will erase everything and install a fresh, clean OS. Be careful, as flashing the wrong firmware can brick your phone.

If you are not comfortable flashing firmware yourself, take the phone to a professional repair shop. They can reflash the device for you. If the phone is still under warranty, contact the manufacturer or seller and ask for a replacement.

Frequently Asked Questions

Can a factory reset remove pre-installed malware?

Sometimes, but not always. If the malware is just an app that was pre-installed in the user data partition, a factory reset will remove it. However, if the malware is in the system partition or the firmware itself, a factory reset will not help because it restores the same compromised system.

Do all cheap Android phones have malware?

No, not all. But cheap phones from unknown brands are at a much higher risk. It is not a guarantee, but the lack of security updates and the incentive to make extra money makes them more vulnerable. It is always safer to buy from a well-known brand, even if it means spending a little more.

Can malware be installed through a system update?

Yes, it can. If a manufacturer’s update server is compromised, or if the manufacturer themselves decides to include tracking or adware, a system update can install malware. This is rare for major brands, but it has happened with smaller ones. That is why it is important to only buy phones from companies that have a good security record.

Is it safe to buy a phone from a third-party seller on Amazon or eBay?

It can be risky. Some third-party sellers are legitimate, but others may sell phones that have been tampered with. If the price seems too good to be true, it probably is. Always check the seller’s ratings and look for signs of tampering, like an already-unlocked bootloader or a custom ROM. If possible, buy directly from the manufacturer or an authorized retailer.

Can I remove pre-installed malware without rooting my phone?

You can try to disable the app in Settings, but you cannot uninstall it without root access. If the app is causing problems, you can use the adb (Android Debug Bridge) command to remove it from your user profile, but this requires enabling Developer Options and connecting to a computer. It is a bit technical, but there are many guides online. However, if the malware is in the system partition, you will need to root the phone or flash a new ROM.

What is the safest way to buy a used Android phone?

When buying a used phone, ask the seller if the bootloader is locked and if it is running the original firmware. If the phone has a custom ROM, assume it has been tampered with. After you get the phone, do a factory reset and then check for any suspicious apps. If you are not comfortable with the risk, consider buying a new phone from a reputable brand instead.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →