Malware
Malware Preinstalled on Budget Android Phones in 150+ Countries, Researchers Say
Security researchers say thousands of low-cost Android devices come with malware preinstalled in their firmware, affecting users in over 150 countries. The campaign, called Midnight Mimosa, gives attackers deep control over infected phones.
Ross GrantUpdated 3 min read
The short version
Security researchers say some cheap Android phones come with malware already installed before you buy them. This malware is hidden deep in the phone's firmware, making it hard to detect or remove. Attackers can control infected phones remotely, using them for things like ad fraud or as part of a botnet. If you have a budget Android device, be alert for strange behaviour.
What happened?
Researchers at Bitdefender found malware preinstalled in the firmware of low-cost Android devices built on MediaTek platforms. The campaign, called Midnight Mimosa, has affected thousands of devices in over 150 countries. The malware gives attackers deep control over infected phones and is difficult to remove. Bitdefender also found related malicious apps on the Google Play Store. Only SecurityWeek has reported this so far.
Malware Hidden in Device Firmware
Security researchers at Bitdefender have found that some low-cost Android phones are being sold with malware already installed in their firmware. Firmware is the software that runs the hardware of a device and loads before the operating system. This means the malware is present as soon as the device is turned on for the first time, and cannot be removed by simply uninstalling an app.
The campaign, named Midnight Mimosa, targets devices built on MediaTek platforms. The malware is a system app with high-level privileges, making it persistent and very difficult for ordinary users to remove or even detect.
Global Reach and Affected Regions
Bitdefender observed thousands of unique infected devices in more than 150 countries over two years. The distribution is global, with no single country dominating. Mexico and France have the most affected devices, followed by Italy, the United States, Germany, Brazil, and Spain. Western Europe and the Americas are the most impacted regions overall. The true scale may be larger, as these numbers are based on devices observed by the researchers.
What the Malware Does
Midnight Mimosa gives attackers system-level control. According to Bitdefender, this allows them to silently install or remove apps, grant themselves permissions, and run any code they want on the device. The main use so far appears to be ad fraud and click fraud: the malware can automatically click on ads to generate revenue for the attackers. It can also turn infected phones into parts of a botnet, a network of compromised devices that can be rented out to other criminals.
The malware can also disable the Google Play Store temporarily to install more malicious apps, then re-enable it to avoid detection by Google's security checks.
Google Play Store Involvement
Bitdefender also found 13 apps on the official Google Play Store that contained the same ad-fraud code as the firmware malware. These apps were published under two developer accounts and used different signing certificates. While these Play Store apps do not have the same deep access as the preinstalled malware, they are considered part of the same campaign and give attackers another way to spread their code.
Supply Chain Threat
This campaign is an example of a supply-chain attack, where the compromise happens before the device reaches the user. In this case, the malware is installed during manufacturing or distribution, not by the end user. This makes detection and prevention much harder, as users receive an infected device straight out of the box.
Bitdefender has published a list of indicators of compromise (IoCs) to help defenders identify affected devices. However, there is no information yet on the total financial impact or whether any vendors have responded.
What You Should Do
If you have a low-cost Android device, especially from lesser-known brands, be cautious. Watch for unusual behaviour like unexpected ads, apps you did not install, or rapid battery drain. Security apps may not detect firmware-level malware, so if you suspect your device is affected, consider replacing it. Keep your device and apps updated, and only install apps from trusted sources.
This story is based on a single report from SecurityWeek, citing Bitdefender research. There is no confirmation yet from Google, device makers, or government agencies. Read the SecurityWeek article for more details. (opens in a new tab)
Claimed vs confirmed
- Unconfirmed
Malware is preinstalled in the firmware of budget Android devices in over 150 countries.
Reported by SecurityWeek citing Bitdefender; not yet confirmed by vendors or authorities.
- Unconfirmed
Thirteen apps on Google Play Store contain related ad-fraud code.
Bitdefender researchers found these apps; no statement from Google.
The impact
- Money
- No financial loss has been reported. If confirmed, affected vendors could face regulatory fines under laws like GDPR, which can reach €20 million or 4% of global turnover.
- Reputation
- Vendors of affected devices could face serious trust issues if their products are found to be compromised at sale. Google Play Store's reputation may also be affected if malicious apps are confirmed.
- Customers
- Users of budget Android phones may be exposed to fraud, privacy risks, and having their devices used in criminal botnets. They should watch for unusual behaviour and consider device replacement if affected.
Why it matters
People in more than 150 countries could be using phones that are compromised from the moment they are switched on. This puts users at risk of fraud, privacy invasion, and being part of criminal botnets. The attack is hard to detect and remove, making it a serious supply-chain security concern.
How does it work?
The malware is installed in the device firmware before sale, giving it system-level privileges. This allows it to silently install or remove apps, grant permissions, and run code remotely. It can also temporarily disable Google Play Store security to install more malicious apps. Because it is part of the firmware, it cannot be removed by normal means.
Key points
- Malware was found preinstalled in the firmware of budget Android devices.
- Thousands of devices in over 150 countries are affected, according to researchers.
- Attackers gain deep control, using devices for ad fraud and botnets.
- Some related malicious apps were also found on the Google Play Store.
- The attack is a supply-chain threat, making detection and removal difficult.
Sources
SecurityWeek
Reference
