Malware
Some Low-Cost Android Phones Ship with Unremovable Malware, Researchers Warn
Security researchers say certain cheap Android phones come with malware preinstalled, running ad fraud and turning devices into botnet nodes. The malware cannot be removed by normal means.
Ross GrantUpdated 4 min read
The short version
Some cheap Android phones come with malware already installed before you even turn them on. This malware shows unwanted ads, collects your device info, and can make your phone part of a botnet. Most people cannot remove it because it is built into the phone's system software. Security experts recommend buying phones from trusted brands and checking for regular security updates.
By the numbers
- thousandsnumber of infected devices observedHelp Net Security
- 150+countries with infected devicesHelp Net Security
What happened?
Security researchers at Bitdefender found that some low-cost Android phones are shipping with malware preinstalled in their firmware. The malware, called "Midnight Mimosa", cannot be removed by normal means and allows attackers to control the device, run ad fraud, and turn phones into botnet nodes. The campaign has affected thousands of devices worldwide, especially in Mexico, France, and Italy. [Help Net Security]
Malware Found Preinstalled on Budget Android Phones
Security researchers at Bitdefender have found that some low-cost Android phones are arriving with malware already installed in their firmware. This means the malicious software is present before the owner even switches the phone on for the first time. The malware, which Bitdefender calls "Midnight Mimosa", cannot be removed by normal methods because it is built into the system software.
The affected devices are mostly budget models built on MediaTek platforms, including some counterfeits that use names similar to well-known flagship phones. Examples include models labelled as "i17 Pro Max", "S25 Ultra", "S24 Ultra", and "Note 18 Ultra". The two most common infected models identified are the Doogee S200 X and the Cubot KINGKONG X. The campaign has been observed on thousands of devices in over 150 countries, with the highest numbers in Mexico, France, and Italy, followed by the United States, Germany, Brazil, and Spain. Help Net Security (opens in a new tab)
What the Malware Does
The malware runs with system-level privileges, which means it can silently install and remove apps, grant itself permissions, and load new code from remote servers. This allows its operators to control the phone almost completely. According to Bitdefender, the main goal appears to be generating revenue through ad fraud and click fraud. The malware collects device information and can turn infected phones into residential proxy nodes, making them part of a botnet. This botnet can then be rented out for other malicious activities, such as distributed denial-of-service (DDoS) attacks.
The malware also gives itself access to sensitive permissions, including Accessibility (which lets it read everything on screen and interact with apps), Notification Access (which exposes chat messages), and SMS (which could allow it to read one-time codes or send premium texts). While Bitdefender did not see these permissions abused during their analysis, they are available to the operators if they choose to use them.
How the Infection Works
The malicious component is a system app that goes by generic names like "System" and does not appear in the app launcher. It is signed with platform-level certificates, sometimes bearing the name of a legitimate device manufacturer, but Bitdefender stresses this does not prove the company is involved. The malware's code is hidden in a native library that only activates at runtime, making it hard to detect.
The system app installs and removes a rotating set of at least 32 disguised apps, such as weather, note-taking, and file manager tools. These apps carry legitimate advertising software development kits (SDKs), so ad networks see them as normal apps and pay for the fake ad views and clicks. The malware can also show ads in windows that cover the screen or appear over other apps, making it difficult for the user to avoid them.
Some of the same ad-fraud code has been found in 13 apps on the Google Play Store, published under different developer accounts. These apps do not have the same system-level privileges but can still display unwanted ads.
Supply Chain Questions and Removal Challenges
Bitdefender says it is not yet clear where in the supply chain the malware is being added. It could be introduced by the original device manufacturer, a firmware integrator, a logistics partner, or another actor. Because the malware is in the system partition, most users cannot remove it. Getting rid of the infection would require advanced technical steps, such as reflashing the device firmware or using developer tools, which are not realistic for most owners of these phones.
What Users Can Do
If you are considering buying a low-cost Android phone, especially from an online marketplace, be cautious. Stick to reputable brands and check for reviews or reports of suspicious behaviour. If your phone shows persistent ads, installs apps by itself, or acts as a proxy, it may be infected. Unfortunately, for most affected users, there is no simple fix. Security experts recommend avoiding unknown brands and ensuring your device receives regular security updates.
Claimed vs confirmed
- Confirmed
Malware is present in the firmware of some low-cost Android phones before first use.
Bitdefender researchers found the malware preinstalled in the system partition of affected devices.
- Denied
The malware can be removed by normal means.
Bitdefender states the malware cannot be uninstalled through normal user actions.
- Confirmed
The malware turns infected devices into botnet nodes and runs ad fraud.
Bitdefender observed the malware using infected phones for ad fraud and as residential proxy nodes.
The impact
- Money
- The malware operators profit from ad fraud and botnet rentals. Affected companies could face costs if regulators investigate supply chain security. Under GDPR, fines can reach €20m or 4% of global turnover for serious breaches.
- Reputation
- Brands associated with infected devices, even if counterfeit, may suffer loss of trust. The issue highlights risks in the supply chain and could deter buyers from lesser-known brands.
- Customers
- People who buy these phones risk privacy violations, unwanted ads, and having their device used for criminal activity. Most users cannot remove the malware and may need to replace their device.
Why it matters
People who buy low-cost Android phones from online marketplaces may unknowingly receive devices that are infected with malware from the start. This puts their privacy and security at risk, and there is no easy way to remove the infection. The issue highlights the risks of buying unknown brands and the importance of supply chain security.
How does it work?
The malware is installed in the system partition of the phone before the owner receives it. It runs with system-level privileges, allowing it to install and remove apps, grant itself permissions, and load new code from remote servers. It can display unwanted ads, collect device information, and turn the device into a proxy for botnet activity. Because it is part of the system firmware, it cannot be removed without advanced technical steps.
Key points
- Some cheap Android phones ship with unremovable malware.
- The malware enables ad fraud and turns devices into botnet nodes.
- It is present before the phone is first used and cannot be removed by normal means.
- Thousands of devices in over 150 countries are affected.
- Stick to reputable brands and check for regular security updates.
Sources
PCMag
Reference
Help Net Security
Reference
