Cheap Android phones found with malware already installed

Security researchers at Bitdefender have uncovered a malware campaign called Midnight Mimosa that infects certain low-cost Android devices before their owners even turn them on. The malicious software hides inside the phone's firmware, giving attackers powerful access that ordinary apps never receive.

According to Bitdefender's investigation, the malware was discovered on low-cost, multi-brand Android devices built around MediaTek chipsets. Researchers found malicious applications embedded in the system software, where they could operate with elevated privileges. These privileges allow the malware to install additional apps without permission, remove existing applications and grant sensitive access to other software.

Global Impact

Bitdefender says it observed Midnight Mimosa on thousands of unique devices across more than 150 countries over approximately two years. Mexico, France and Italy had the highest observed numbers, followed by the United States, Germany, Brazil and Spain. Researchers also observed infected devices reporting model names associated with Doogee's S200 X and Cubot's KINGKONG X.

Another part of the investigation uncovered devices pretending to be expensive smartphones. Some reported names resembling Samsung Galaxy flagship models, while others imitated Apple's iPhone naming. In other words, a phone advertised as a premium Samsung or Apple device might actually contain inexpensive Android hardware running modified software.

Malware Capabilities

Midnight Mimosa appears primarily designed to generate money for its operators while staying out of sight. One way it earns money is through advertising fraud. The malicious system component silently installs apps that look like weather tools, app lockers and other everyday utilities. Those apps can display legitimate advertisements in hidden windows or generate clicks without the owner touching the screen.

Researchers also discovered software that can turn infected phones into residential proxy servers. Someone operating the malware could route internet traffic through your phone's connection. To websites and online services, that traffic may appear to come from your home or mobile network rather than the person actually controlling it.

Evasion Tactics

One particularly troubling finding involves how Midnight Mimosa avoids security checks. Before installing certain malicious apps, Midnight Mimosa temporarily disables the Google Play Store app. Bitdefender believes this helps the malware avoid detection by Google Play Protect during installation. Once the process finishes, the malware re-enables the Store, reducing the chances that the phone owner will notice anything unusual.

Some versions also manipulate Android's installer records to make applications appear to have come from Google Play, even when the malware installed them directly. So a quick look at where an app supposedly originated may not tell the whole story.

Identified Apps

Bitdefender identified 13 unique disguised applications involved in the operation: Wavrge, App Icon DIY, Audify, QR Pocket, All Deleted Messages Recovery, WeatherGo, CoolWeather, Daily Weather, Lock & Hide, QuickText Extractor, NoteMaster, Tap to Translate and Tasky. These apps offered functions such as weather forecasts, QR scanning, message recovery and audio editing.

Checks of the Google Play listings for all 13 apps found that none were available for download. However, it remains unclear whether Google removed the apps or their developers withdrew them. If you find one of these applications on your phone, verify that its package identifier matches the one listed in Bitdefender's report before uninstalling it.