Analysis of a cheap Android projector that ships with a malware loader for c2

A researcher bought a cheap Android projector (Magcubic HY310) and, after connecting it to an isolated network with packet capture running, found it silently installed a system-privileged ad app, carried a dormant copy of a known malware loader that could be activated remotely, and sent app-usage telemetry to its maker…