Another problem is with the cheap Android devices that come with a preinstalled rootkit disguised as the firmware update app. (fota.apk)

It uses LUA scripts to install apps remotely and can grant any app any permission and run as system level through reflection.

The government funded LifeLine phones that are given to the poor, disabled and veterans are all infected with this malware.

Here is an excellent technical analysis of the rootkit:

https://wuffs.org/blog/digitime-tech-fota-backdoors