@kazani
Bitdefender's security researchers have identified a malware campaign (dubbed Midnight Mimosa) running on low-cost, multi-brand Android devices built on MediaTek platforms.
The malware ships preinstalled in the device firmware, and we found multiple system packages involved, depending on the device. It's on the phone before the owner switches it on for the first time, and it can't be uninstalled.
https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware