Chinese Smartphones With Malware in Their Firmware Are Sold on Ozon, Wildberries and Yandex Market

Malware in the firmware of Chinese smartphones, according to CNews, is no longer an exotic threat. Devices with a factory-installed "surprise" are on sale in Russia on the three largest marketplaces: Ozon, Wildberries and Yandex Market. One of the affected brands, Doogee, even has an official Russian online store. The initial report is short: it lists no models, no trojan names and no count of infected devices. Below, we separate what is known from what still needs to be verified.

How the virus gets into a phone before you buy it

This type of attack is called a supply chain attack. A low-cost Android smartphone is assembled from other companies' components and software: the OEM takes a reference firmware, and contractors add drivers, apps and updates. If malicious code enters at any one of these links, it ends up in the system partition. The user gets a device that is already infected the first time it is switched on.

Ordinary tools cannot remove this kind of infection. A factory reset wipes the user partition, but the system partition stays as it was. A trojan lodged there can quietly install apps, swap links, show ads, and steal messenger data and payment details.

There are long-standing precedents. Google described the Triada trojan, which reached devices through the supply chain, as far back as 2019. In 2025, Kaspersky reported Triada on counterfeit smartphones owned by Russian users. According to Google's estimate, the BadBox 2.0 botnet affected more than 10 million devices, mostly cheap Android set-top boxes and tablets. All of this is outside context: it is not directly tied to the specific models in the CNews report.

What the report establishes

• Source: CNews, published October 9, 2026.
• Sales channels: Ozon, Wildberries, Yandex Market.
• Brand named in the report: Doogee, with an official Russian online store.
• Vector: malware embedded in the firmware at the production stage.
• Not disclosed: specific models, malware names, number of affected devices, reaction of the marketplaces and the manufacturer.

The missing data matters. Without a technical report from an antivirus company, it is impossible to claim that every smartphone from the brand is infected. It is also possible that the problem affects only individual batches or specific firmware revisions.

Why marketplaces do not filter out such devices

Marketplaces check the seller's documents, certificates and reviews. Firmware analysis of every model is not part of that process: it requires a lab, samples and time. For budget electronics, where the assortment changes every month, such screening is economically burdensome. Meanwhile, the buyer sees a familiar product page and reasonably assumes the platform is responsible for security.

An official brand store does not solve the problem. A store sells what the factory produced. If the malware is baked in at the level of the manufacturer or its contractor, the sales channel makes no difference.

What owners and buyers should do

First, check whether you own a smartphone from a little-known budget brand bought in recent months. Second, look in the settings for apps you did not install, and check whether the system is requesting unusual permissions, such as access to SMS or the ability to draw over other windows. Third, watch for abnormal background traffic and fast battery drain.

If you suspect an infection, do not enter bank or messenger passwords on the device. Ask the manufacturer for a clean firmware image and compare checksums. If you cannot get confirmation, replacing the smartphone is safer. For critical tasks, choose models with a public security update policy and Google Play Protect certification. Corporate buyers should ask the supplier for a firmware audit report before purchasing a batch.