Pre-Installed Apps and Bloatware Security Guide

Software that ships on a device before you ever switch it on runs with the trust of the manufacturer, and some of it is unnecessary, poorly secured or, in the worst cases, malware placed in the firmware during the supply chain. Pre-installed software ranges from harmless trial apps through vendor utilities with system privileges to backdoors such as Triada and BADBOX 2.0 that live in the system image and survive a factory reset. This guide explains the categories of pre-installed software, how firmware-level malware gets onto devices, what you can safely remove on Windows and Android, and how to buy, provision and monitor devices so the problem does not arrive with them. It is for endpoint, mobile and IoT teams, procurement and security architects.

Key takeaways

Not all bloatware is equal. Separate nuisance apps from privileged vendor agents and from software in the system partition; the controls for each are different.
Firmware-level malware survives a factory reset. Triada and BADBOX 2.0 were found in system images and device firmware, so the fix is clean firmware or replacement, not an app uninstall.
Procurement is the strongest control. Buying certified devices from known channels, with a clean or business image, prevents most of the risk; the FBI lists devices that are not Play Protect certified and unknown brands as BADBOX 2.0 indicators.
Remove at provisioning, not by hand. Strip provisioned packages from Windows images and use Android Enterprise fully managed provisioning so new devices start clean.
Watch the network, not just the device. Unexplained outbound traffic is often the only sign that a cheap streaming box, projector or tablet has joined a residential proxy botnet.

Categories of pre-installed software

Category	Examples of what it does	Typical privilege	Risk	Usual action
Trial and promotional apps	Games, trial security suites, shopping and media apps	Normal user apps	Attack surface, data collection, update gaps	Remove from image
OEM utilities and update agents	Driver and firmware updaters, support assistants, hardware control panels	Often a system service or local administrator	Vulnerabilities in privileged services, local privilege escalation, unsafe update channels	Keep only those you need and manage their updates
Carrier and partner apps	Carrier account apps, partner app stores	Often system apps on mobile	Extra install channels, data sharing	Disable where the platform allows
Traffic-inspecting adware	Ad injection that intercepts HTTPS	Installs a root certificate	Breaks TLS trust for every application	Remove the software and the root certificate
Firmware or system-image malware	Backdoors in the Android framework or system partition	System, inside every app process	Credential and account theft, fraud, proxy abuse	Reflash clean firmware or replace the device

The traffic-inspecting adware case is the clearest example of a nuisance becoming a security failure. CERT/CC advisory VU#529496 describes how Superfish Visual Discovery, bundled on some Lenovo consumer laptops, used Komodia libraries that installed a root CA certificate whose private key was hard-coded and easy to recover, letting an attacker spoof HTTPS sites without browser warnings. CERT/CC noted that uninstalling the application did not remove the root certificate, which had to be removed separately. See the Certificate trust stores and root CA management guide for auditing trust stores.

How firmware-level malware reaches devices

Triada

Google's Android security team described in June 2019 how Triada, first seen in 2016 as a rooting trojan, became a backdoor pre-installed in the Android framework. Google observed the shift around summer 2017 and said the infection entered through a third party that OEMs contracted to add non-AOSP features such as face unlock, with the returned system image infected along the way. Because it was injected into the Google Play app, Triada could install apps without the user enabling unknown sources. Google removed it through Google Play Protect, worked with OEMs on system updates, and added Triada indicators to the system image scans in its Build Test Suite. Its recommendations to OEMs were to review all third-party code and trace it to source, limit added features to the requested function, and security-review system images after third-party code is added and with every over-the-air update.

In 2025 Kaspersky reported a new Triada variant on counterfeit devices that imitated popular smartphone brands and were sold through online marketplaces. The malicious library sat in /system/framework/arm/binder.so and /system/framework/arm64/binder.so and was loaded into Zygote, the parent of every Android app process, so it ran inside every application. Kaspersky said it swapped cryptocurrency wallet addresses, stole Telegram and WhatsApp sessions, intercepted SMS including verification codes, counted over 4,500 infected devices in its telemetry, and recommended installing clean firmware and not using messaging, wallet or social apps on the device until then.

BADBOX 2.0

The FBI's public service announcement I-060525-PSA of 5 June 2025 warned that BADBOX 2.0 had infected millions of IoT devices, including TV streaming devices, digital projectors, aftermarket vehicle infotainment systems and digital picture frames. Devices were infected before purchase with pre-installed malware or during setup when they downloaded apps containing backdoors, and the compromised devices were used as residential proxies whose access was sold for criminal activity. In July 2025 Google filed a lawsuit against 25 unnamed individuals in China it alleged were behind the botnet, which it said comprised more than ten million infected devices as of April 2025, according to reporting by The Register.

These cases map to MITRE ATT&CK for Mobile T1474.002 (Supply Chain Compromise: Compromise Hardware Supply Chain) and T1474.003 (Compromise Software Supply Chain), and to Enterprise T1195.003 (Compromise Hardware Supply Chain). See the Mobile Malware Guide, the Residential Proxy Networks and Abuse Guide and the Ad fraud and connected TV ad fraud guide.

Warning signs

Indicator	Source	What to do
Android device not Play Protect certified	FBI PSA; Google Play certification help	Check in Play Store, Settings, About, or Google's certified device list; do not use for corporate data
Requests to disable Google Play Protect	FBI PSA	Treat as hostile; do not comply
Generic streaming boxes sold as "unlocked" or offering free content; unrecognisable brands	FBI PSA	Exclude from procurement and from corporate networks
Unofficial app marketplaces pre-installed	FBI PSA	Remove or reject the device
Firmware build fingerprint that differs from the official build	Kaspersky Triada research	Compare with the manufacturer's published build; reflash or return
Unexplained or suspicious internet traffic	FBI PSA	Isolate the device and investigate destinations
Unknown root CA certificates in the trust store	CERT/CC VU#529496	Remove the software and the certificate; check every device from the same image

The FBI notes that an indicator alone does not prove malicious activity; use these to decide what to investigate.

What you can remove, and how

Windows

Provisioned Store apps: Remove-AppxProvisionedPackage -Online -PackageName <name> removes a provisioned package from the image so new user accounts do not receive it; Microsoft documents that it does not remove the app from existing accounts, for which Remove-AppxPackage is used. Use -Path to service an offline mounted image before deployment.
OEM services and agents: uninstall through your management tool after confirming which driver and firmware update functions you will cover another way. If you keep an OEM update agent, manage it like any privileged service: patch it, restrict who can trigger it, and monitor it.
Clean images: many organisations reimage with their own build or use the OEM's business image so consumer software never lands. The Application Allowlisting Guide covers stopping unwanted software from returning.

Android

User-installed pre-loads: apps outside the system partition can be uninstalled normally.
System apps: apps in the system image cannot be fully removed without reflashing. On managed devices, Android Enterprise fully managed provisioning disables non-required system apps by default, and the device policy controller can re-enable specific ones. ADB commands that disable or remove an app for the current user change only the user profile, not the system image; see Android Platform Tools and ADB for the risks of using ADB on fleet devices.
Firmware malware: no app-level step removes it. Install clean manufacturer firmware, or retire the device. A factory reset restores the infected system image.

Smart TVs, streaming boxes and other IoT

Removal is rarely possible. Control these devices through procurement and network isolation instead. See the IoT Security Guide.

Choosing an approach

Situation	Approach	Trade-off
Small organisation buying laptops retail	Buy business lines, remove provisioned apps with a script at enrolment, block unknown root certificates	Some OEM utilities removed may handle firmware updates; replace that function
Large Windows estate	Own reference image or OEM clean image, Autopilot or equivalent, allowlisting	Image maintenance effort
Corporate Android phones	Android Enterprise Recommended devices, fully managed provisioning, approved app list	Narrower device choice
BYOD Android	Work profile only, minimum OS and certification checks before access	No control over the personal side of the device
Meeting room TVs, projectors, signage	Approved models list, isolated VLAN with egress allowlist	Some cloud features stop working

See the Android Enterprise Security Guide and the Mobile Device Management Security Guide.

How to implement

Set a device purchasing standard. Approved models and channels only; certified Android devices; no unbranded IoT on corporate networks; supplier contract terms on pre-installed software and firmware integrity. See the Hardware Trojans and Chip Supply Chain Guide.
Inventory what ships. Unbox one device of each model, list every installed app, service, scheduled task, driver, browser extension and root certificate, and record the firmware build. This becomes the baseline. See Software Asset Management for Security.
Decide per item: keep and manage, remove at provisioning, or reject the model.
Build removal into provisioning. Remove provisioned Windows packages in the image or task sequence; use fully managed Android provisioning; record the result.
Pilot one model and one user group. Check that drivers, firmware updates, docking, audio and camera still work, and that nothing removed is needed by support. Roll back by redeploying the previous image or re-enabling the system app from the device policy controller.
Isolate devices you cannot clean. Put TVs, projectors and similar devices on a separate network with only the destinations they need.
Repeat on every model change and major update. OEM updates can reinstall software.

Detection and measurement

Software inventory drift: compare installed software against the model baseline and alert on new pre-installed or OEM components after updates.
Trust store audits: alert on root certificates not in the approved list.
Network egress: monitor IoT and mobile segments for proxy-like behaviour, high connection counts and connections to unknown destinations.
Device attestation and certification: use MDM compliance checks for certification, bootloader state and OS build.

Metrics:

Percentage of devices bought through approved channels and models.
Percentage of Android devices that pass certification and integrity checks.
Number of unapproved pre-installed components per model baseline (falling).
Number of devices on corporate networks that are not in the asset inventory.
Mean time to isolate a device showing suspicious egress.

Common failure patterns

Uninstalling the app and keeping the certificate, as CERT/CC warned for Superfish, leaving TLS interception possible.
Factory resetting a device with firmware malware and assuming it is clean.
Removing OEM update agents without a replacement for driver and firmware patching, trading bloat for unpatched firmware.
Buying cheap streaming boxes or tablets for meeting rooms and connecting them to the corporate network.
Hand-cleaning devices rather than building removal into provisioning, so every reimage or new user brings the apps back.
Allowing uncertified Android devices into BYOD because they pass a basic MDM enrolment.

Where identity fits

Firmware malware such as the 2025 Triada variant targets session tokens and one-time codes, so a compromised phone undermines SMS and app-based authentication. Prefer phishing-resistant authenticators, require device compliance and certification checks before granting access, and revoke sessions for any account used on a device later found to be infected. Privileged OEM agents also often run as system services with their own update credentials; inventory them as non-human software identities.

Framework mapping

Framework	Reference	Relevance
NIST SP 800-53 Rev. 5	CM-7, CM-11, SI-7	Least functionality, user-installed software, software and firmware integrity
NIST SP 800-53 Rev. 5	SR-3, SR-11	Supply chain controls and component authenticity
NIST CSF 2.0	PR.PS-01, DE.CM-09	Configuration management and monitoring of hardware and software
CIS Controls v8.1	Control 2 and Control 4	Software inventory and secure configuration
ISO/IEC 27001:2022 Annex A	A.5.21, A.8.9, A.8.19	ICT supply chain security, configuration management, installation of software
MITRE ATT&CK	T1474.002, T1474.003, T1195.003	Mobile and enterprise supply chain compromise

Practitioner checklist

NHI Mgmt Group recommends the following checks.

Publish an approved device models and channels list, including IoT and meeting room devices.
Require Play Protect certification for Android devices that touch corporate data.
Baseline every model's pre-installed software, services and root certificates.
Remove unwanted provisioned packages in the Windows image, not by hand.
Use fully managed Android provisioning for corporate phones.
Keep or replace OEM firmware update functions deliberately.
Reflash or retire devices with system-image malware; never rely on a factory reset.
Isolate devices you cannot clean and monitor their egress.
Re-check baselines after every major OEM update.

Pre-Installed Apps and Bloatware Security Guide: Firmware-Level Malware, Risky Vendor Apps and What You Can Remove