The threat involves a pre-installed malware ecosystem on cheap Android projectors based on the Allwinner H713 platform, including brands like Nonete HY260Pro and others. The infection chain consists of StoreOS (stage 1 dropper), SilentSDK (stage 2), PluginManager com.me.cash5 (stage 3), and multiple final plugins (stage 4) that enroll devices into residential proxy botnets, ad-fraud schemes, and UDP proxy nodes. The malware communicates with C2 servers such as api.pixelpioneerss.com and others, with infrastructure located in China and Germany. The malware has root backdoors (e.g., open ADB on port 5555) and can execute arbitrary code with system privileges, allowing operators to push any payload. Device identifiers (MAC, serial, Android ID) are exfiltrated. The malware uses obfuscation techniques including byte-reversal, XOR encryption, and build-fingerprint spoofing. Independent confirmation suggests the problem is widespread across multiple brands using the same firmware base. Immediate mitigations include network-level blocking of known C2 domains and IPs and disabling malicious apps via ADB.

Affected devices are enrolled in multiple botnets and proxy networks, enabling attackers to route traffic through victim devices, conduct ad and click fraud, and potentially deploy arbitrary malicious payloads with root privileges. The malware exfiltrates sensitive device identifiers to servers in China. The presence of open root backdoors and unauthenticated ADB access increases the risk of full device compromise. The geo-fencing capability allows attackers to target specific countries selectively. This compromises device integrity, privacy, and can facilitate broader criminal infrastructure.

No official vendor patch is available as this is a supply chain compromise in pre-installed firmware. Immediate mitigations include blocking network traffic to known C2 domains (e.g., api.pixelpioneerss.com, *.aodintech.com, *.syslogcollector.com) and IP addresses associated with the malware at the network perimeter. Users can disable malicious apps using ADB commands to reduce risk. Since the malware operates with root privileges and includes backdoors, replacing the device or firmware with a trusted version is recommended for full remediation.