Malware Found Preinstalled on Budget Android Phones Across 150 Countries

Security researchers at Bitdefender say they have identified malware embedded directly into the firmware of low-cost Android smartphones sold in more than 150 countries, meaning the malicious code is active before a buyer even switches the phone on for the first time.

The campaign, which researchers have named "Midnight Mimosa," was detailed in a report published by Bitdefender Labs and first surfaced publicly through coverage from Hackread. The firm said it had tracked thousands of infected devices over a roughly two-year window, with the United States, Mexico, France and Italy among the countries most affected. Rather than stealing personal data, the operation appears designed purely to generate money: it quietly runs background advertisements to fake clicks and impressions, and it turns infected phones into "residential proxies," routing other people's internet traffic through the victim's connection and IP address so that traffic looks as if it originates from an ordinary household rather than wherever the real user is located.

Hidden before the first power-on

According to the research, the malware ships inside devices built on MediaTek chipsets, including counterfeit phones marketed under names mimicking flagship models such as "S25 Ultra" and "i17 Pro Max," as well as genuine budget-brand devices including the Doogee S200 X and the Cubot KINGKONG X. It hides inside two system packages, running with system-level privileges normally reserved for the operating system itself. Because of that privilege level, the malware cannot be removed through a standard factory reset or app uninstall — the kind of fix that works for most ordinary infections.

Bitdefender said the code can silently install or remove applications, grant itself additional permissions, and briefly disable the Google Play Protect scanning service immediately before installing its payloads, a maneuver that appears intended to dodge Android's built-in malware checks. It can also disguise sideloaded apps so they appear to have come from the Google Play Store. Separately, researchers found the same ad-fraud code operating inside 13 apps that had been distributed through Play itself. "Every user-facing defense had already been bypassed" by the time a new owner turned the phone on, the firm said of the infected devices it examined, according to a separate account of the findings.

Investigators traced a platform certificate used by one of the malicious packages to a Chinese firm, though Bitdefender was careful to say that link does not establish the company knowingly inserted or distributed the malware. Exactly how the code entered the supply chain — whether through a compromised firmware vendor, a rogue factory partner, or some other point between design and retail shelf — remains unknown, the firm said.

For consumers, the findings complicate what is usually simple troubleshooting advice. Because the infection lives in system firmware rather than in an app a user installed, Bitdefender said remediation may require a full firmware replacement from the manufacturer or, in practice, buying a different phone altogether. The firm recommended that budget-phone buyers stick to recognized brands sold through authorized retailers, watch for unexplained battery drain or data use, and avoid devices advertised at prices far below those of comparable genuine models — a red flag the counterfeit "S25 Ultra" and "i17 Pro Max" devices in this campaign illustrate directly.

The discovery adds to a history of malware surfacing on inexpensive Android hardware aimed at price-sensitive buyers, a problem researchers have documented periodically for close to a decade. What distinguishes Midnight Mimosa, Bitdefender argues, is both its geographic spread and its focus on monetization infrastructure — ad fraud and proxy resale — rather than the credential theft or spyware that has characterized many earlier firmware-level campaigns.