The malware discovered by Check Point  included info-stealers, ransomware and “illegitimate advertisements” which generate revenue while stealing device information; and information stealers.

Check Point says it found infections in 38 Android devices and none of the malware was in the vendor's ROM. Checkpoint's Oren Koriat thinks that they were added in the supply chain between vendor and customer.

"The discovery of the pre-installed malware raises some alarming issues regarding mobile security. Users could receive devices which contain backdoors or are rooted without their knowledge. To protect themselves from regular and pre-installed malware, users should implement advanced security measures capable of identifying and blocking any abnormality in the device’s behavior," Koriat said.

“Six of the malware instances were added by a malicious actor to the device’s ROM using system privileges, meaning they couldn’t be removed by the user and the device had to be re-flashed”, Koriat said.

 List of malware APKs, Shas, and Affected devices