Budget Android Phones Arrive With Malware Already Built Into the Firmware

Romanian security firm Bitdefender has reported on a campaign it tracks as Midnight Mimosa. The malicious code is embedded directly in the factory firmware of low-cost Android smartphones built on MediaTek platforms and sold under several brands. The buyer receives an already-compromised device straight out of the box.

What the malware does

The component (com.android.system.lite) runs with system-level privileges. That lets it silently install and remove at least 32 disguised apps, grant itself access to accessibility services, notifications, and SMS, and load and execute arbitrary code supplied remotely by its operators. It pulls a configuration from an external server and then downloads additional payloads.

According to the researchers, the operators can add or delete apps at will, tuning each device to their needs — including making it part of large botnets. The scheme appears built mainly to generate revenue: ad and click fraud, harvesting device and installed-app data, and turning phones into residential-proxy relay nodes.

The system module itself does no clicking. The monetization is handled by dropper apps that pose as harmless utilities and load genuine ads through a legitimate advertising SDK. An invisible window is drawn on top of other apps and registers the ads supposedly being shown.

Not only firmware

Bitdefender found 13 apps on Google Play tied to the same control servers — weather tools, QR scanners, and other utilities. Unlike the preinstalled malware, these apps actually work, but they display ads outside the app, including when the phone is idle. None are currently available in the store.

Notably, the malware disables the Google Play Store app before installing a payload — likely to slip past Play Protect — and re-enables it afterwards.

A supply-chain compromise

Some infected devices carried firmware signed with certificates attributed to Chinese manufacturer Shenzhen Zediel Co., Ltd., though it is unclear whether the certificate owner was involved. The infrastructure partly overlaps with the Android.Phantom campaign documented by Doctor Web in January 2026.

Most infected devices are in Mexico, followed by France, Italy, the U.S., Germany, Brazil, and others. Over roughly two years the malware has been seen on thousands of unique devices across more than 150 countries; many are cheap white-label or counterfeit phones, some borrowing the names of Samsung Galaxy models and even iPhones.

Bitdefender stresses that preinstalled malware is a different threat class. Ordinary defenses assume the owner is in the loop at installation. The root component ships in the system partition and cannot be removed the normal way — clearing it requires firmware-level cleanup or disabling it over ADB, neither realistic for most buyers. The durable fix rests with the vendors and marketplaces that ship the affected firmware.

Source: The Hacker News