April 16, 2025 By Pierluigi Paganini
Cheap Chinese Android phones ship with trojanized WhatsApp and Telegram clones hiding crypto clippers, active since June 2024.
Since June 2024, Doctor Web researchers found cheap Android phones preloaded with fake WhatsApp and Telegram apps designed to steal crypto via clipping.
These clippers swap copied wallet addresses with the attackers’ own. The campaign targeted low-end phones mimicking famous models, using altered system info to trick users. Attackers infiltrated the supply chain, embedding malware in pre-installed apps.
Doctor Web warns that the attackers gained access to the supply chain of a number of Chinese manufacturers of Android-based smartphones. The experts found malware-laced applications pre-installed on the phone.
