Cheap Android Phones Found Shipping With Hidden Malware

A cybersecurity firm called Bitdefender has found malware built directly into the firmware of thousands of cheap Android phones, sold under the campaign name Midnight Mimosa. The malware is present before the owner even switches the phone on for the first time, and cannot be removed by normal means. It mainly exists to generate fraudulent advertising revenue, but it runs with system-level privileges, meaning it can quietly install other software without asking.

The phones affected are largely low-cost, white-label or counterfeit devices, some designed to resemble well-known Samsung or Apple models without being genuine. They use chips made by MediaTek and have turned up across more than 150 countries over roughly two years, with Mexico, France and Italy the most affected so far. It is not yet known who put the malware there, or at which point in the manufacturing and supply chain it was introduced.

What this actually means for you

This is not a story about Android phones in general. It is a story about a specific type of phone: very cheap, often unbranded, sometimes made to look like a flagship device it is not. If you have bought a mainstream phone, such as an official Samsung, Google or Apple device, from an authorised retailer, none of this points to a problem with your phone.

If you own, or are thinking of buying, a very cheap Android phone of uncertain origin, the picture is different. The malware found by Bitdefender hides as ordinary-looking apps: weather widgets, note-taking tools, app lockers, file managers. At least 32 disguised apps have been identified so far. They load real adverts but show them in windows you never see, racking up fake ad views, and some can generate automated clicks on your phone's behalf. Before installing some of these, the malware briefly switches off the Google Play Store, which may be an attempt to avoid detection.

Separately, Bitdefender also found 13 apps on the official Google Play Store that talk to the same infrastructure and contain the same ad-fraud code. Those apps do real work too, which is presumably why people kept them installed, but they also push ads outside the app itself, including while the phone sits untouched.

What to do

• Be wary of phones that are suspiciously cheap for what they claim to be, particularly ones that look like a Samsung Galaxy or an iPhone but are sold at a fraction of the price.
• Buy phones from retailers you recognise, or from a brand's own official store, rather than from unfamiliar sellers on general marketplaces.
• If you already own a low-cost or counterfeit-looking Android phone, watch for fast battery drain, data use you can't explain, apps you don't remember installing, or the Play Store switching itself off and on.
• If you're concerned your phone may be affected, don't assume a quick fix will sort it. Contact the retailer, get the device checked by someone who knows what to look for, or replace it.
• Before buying a second-hand or marketplace phone, it's worth checking the listing and seller details carefully. Veystrix's free scam checker at /tools/scam can help you weigh up whether a listing or message looks genuine.

What this does not fix

Because the malware sits in the phone's firmware, below the level of normal apps, a factory reset will not remove it, and installing an antivirus app will not either. There is no uninstall button for this. If a device is affected, the realistic options are getting it checked by someone qualified or replacing it. A VPN also will not remove firmware-level malware: it can hide what you're doing online from your internet provider and from snoopers on public Wi-Fi, but it has no way to reach inside a phone's operating system. The honest answer here is that prevention, buying from a retailer you trust, matters more than any after-the-fact fix.