Preinstalled malware is malicious software that is already present on a device before the user installs any apps or performs normal setup. It may live in the operating system image, factory firmware, or a vendor app bundle, so it can start with elevated trust and survive basic cleanup steps. Unlike a typical download-based infection, the threat can exist before the owner notices anything unusual.
This matters because it breaks the usual security model of "install, scan, remove." If the compromise is baked into the device, antivirus tools and app permissions may not reach it. In real attacks, preinstalled malware is used to spy, show ads, steal credentials, or create a hidden foothold. Defenders look for trusted supply chains, signed firmware, verified updates, and devices that can be reimaged or audited before deployment.