Buying a budget smartphone can seem like a savvy choice. After all, why spend more on a device that promises you a large screen, satisfactory cameras, and access to all those essential Android apps? But what if that seemingly great deal hides a nasty surprise already lurking in the phone when you take it out of the box?
Security experts from Bitdefender have revealed a malware scheme dubbed Midnight Mimosa that infects specific low-cost Android devices even before their owners power them on.
The dangerous software is embedded within the phone’s firmware, granting cybercriminals a level of access that regular applications simply don’t have. What’s even more alarming is that researchers identified harmful applications related to this malware on Google Play, with reports indicating that this issue has now spread to the United States.
Malware Installed Directly from the Manufacturer
Most advice about keeping smartphones secure usually focuses on being cautious about what apps you install. This is understandable because malicious apps can trick you easily. However, Midnight Mimosa rewrites that narrative since the malware can arrive as part of the phone itself. From Bitdefender’s findings, the troubling malware was found on low-cost Android devices utilizing MediaTek chipsets. They found nefarious applications woven into system software where they can run with higher privileges than typical apps.
These enhanced privileges let the malware install further applications without obtaining permission, delete existing ones, and provide sensitive access to other software. It also has the ability to download and execute new code from remote servers. Researchers pinpointed several versions of this malware hiding behind seemingly benign Android package names, which include com.android.system.lite, com.android.sys.prot, and com.android.sys.gmsprot.
To the average user, those names would appear as normal technical components. This very aspect makes it tough to detect, and since the malicious software resides in the system partition, a regular uninstall won’t clean up the underlying infection.
Widespread Impact on Global Devices
Bitdefender observed Midnight Mimosa across thousands of unique devices in over 150 countries, spanning nearly two years. Mexico, France, and Italy reported the highest numbers, with the United States, Germany, Brazil, and Spain also affected. They noted certain models associated with brands like Doogee’s S200 X and Cubot’s KINGKONG X as linked to these infections.
That said, not every device branded under those names is guaranteed to be affected. Issues arise as some devices in the report used counterfeit or misleading model identifiers, complicating the identification of infections based solely on reported names.
Remarkably, researchers discovered some devices masquerading as high-end smartphones, with names that mimic Samsung Galaxy flagship models and even Apple’s iPhones. So, a phone that’s marketed as being a premium Samsung or Apple could actually be running lower-end Android hardware with altered software.
Instances were found where counterfeit devices even mimicked legitimate Samsung model identifiers, making it unreliable to verify authenticity just by checking model names. Additionally, the investigation revealed firmware signed with certificates from Shenzhen Zediel, a Chinese manufacturer, but Bitdefender clarified that this does not necessarily imply that the company created the malware or was aware of its presence. The exact point of entry for the malicious code during manufacturing and distribution remains elusive.
What the Hidden Malware Does
You might assume that such potent malware would quickly steal your passwords or throw up blatant warnings. Instead, Midnight Mimosa seems designed to generate revenue for its operators, all while flying under the radar. One method it employs for profit is through advertising fraud— the malevolent system component quietly installs apps that resemble weather tools, app lockers, and other utilities.
These downloaded applications can show legitimate ads in covert windows or generate user clicks without any interaction from the owner. Consequently, advertisers might end up paying for activities that are simply not from genuine users. Bitdefender found at least 32 diverse disguised applications involved in this larger scheme, and the malware is capable of continuously installing and uninstalling them, making detection even more difficult.
Your Phone Could Become Part of a Botnet
The advertising fraud is just part of the narrative, though. The researchers also uncovered software enabling infected phones to act as residential proxy servers. This means that someone managing the malware could channel internet traffic through your phone, concealing the actual source of that traffic when reaching websites and services.
This setup can be advantageous for cybercriminals, as it obscures where online activities originate. Such infrastructure might also support larger botnet functions or distributed denial-of-service (DDoS) attacks. Bitdefender confirmed that the malware possesses the capability to convert infected devices into residential proxy servers.
However, the researchers later explained that one server they encountered was actually a sinkhole— a system intended to intercept malevolent communications— and their tests didn’t show active traffic being relayed through the infected device. Still, the potential remains a worry, as it could allow operators to route traffic through your internet connection.
Malware that Temporarily Disables Google Play
Another concerning insight involves how Midnight Mimosa dodges security checks. Before it installs certain harmful applications, it temporarily disables the Google Play Store app, which likely helps it avoid detection from Google Play Protect during the installation phase.
Once this process is complete, it reactivates the Store, decreasing the chances that a user might notice anything odd. This entire operation takes place without user involvement. Some malware versions even manipulate Android’s installation records to make it look like apps had come from Google Play, even if they were installed directly by the malware. As such, a quick glance at an app’s source may not reveal the complete picture.
Identified Apps in the Investigation
The investigation pointed out 13 specific apps: Wavrge, App Icon DIY, Audify, QR Pocket, All Deleted Messages Recovery, WeatherGo, CoolWeather, Daily Weather, Lock & Hide, QuickText Extractor, NoteMaster, Tap to Translate, and Tasky. These apps, which provided functions like weather forecasts and QR scanning, were also involved in generating unwanted advertising activity— such as displaying ads outside of their normal interfaces.
Unlike the malware intertwined with phone firmware, these apps didn’t have the elevated privileges required to silently install other applications. The identified apps were linked with 13 different signing certificates and at least two developer accounts, recognized as fivedev and CPS Developer.
What about their availability on Google Play? A review of the listings for all 13 apps found that none of them were currently downloadable. It’s not clear if Google pulled them, or if their developers chose to withdraw them. Attempts to reach Google for comment yielded no response prior to deadline.
If you spot any of these apps on your phone, you should cross-check the app’s package identifier with that found in Bitdefender’s report before proceeding to uninstall it. Different apps can share similar names, and even if an app disappears from Google Play, it might still be on your device. This underscores how just downloading from an official store doesn’t inherently promise safety.
Reports of Malicious Software Returning Post-Removal
Furthermore, findings align with complaints from some owners of Doogee and Cubot smartphones on XDA forums. Users mentioned strange system applications that popped up again after attempts to remove them. One example cited a Doogee Fire 3 Max owner who claimed that an official firmware update led to the infection. They noted that reverting to an older firmware version solved the issue, but reinstalling the newer update brought the problem back.
Other forum members indicated that later firmware updates fixed their infections. Bitdefender did identify one suspicious package discussed in those forums as being tied to the same malware family. This creates a frustrating situation for device owners. Normally, I encourage people to install software updates for heightened security. But when the very firmware is at risk, the source and integrity of the update become highly critical.
How to Safeguard Your Android from Preinstalled Malware
Ideally, the best defense begins even before you buy a device. However, there are effective measures to take if you already own a budget Android phone or suspect something’s off.
1. Purchase from Trustworthy Retailers and Verify Devices
Be extremely cautious with unusually inexpensive smartphones marketed as premium models. These counterfeit devices can mimic familiar names and looks while functioning with entirely different hardware. Aim to shop with recognized retail stores and authorized sellers whenever you can.
Check the manufacturer’s official website to ensure that the model exists and corresponds with the advertised specifications. A suspiciously low price warrants a closer inspection, particularly when a seller provides minimal information regarding software updates or warranty support.
2. Confirm Your Android Phone’s Google Certification
Before trusting an unfamiliar Android device, check if Google has certified it. Play Protect certification means a device has met Google’s compatibility standards, but it doesn’t guarantee malware-free firmware.
To check:
- Open the Google Play Store.
- Tap your profile picture in the upper-right corner.
- Select Settings.
- Tap About.
- Look for Play Protect certification.
- Check if the status reads Device is certified.
If it states Device is not certified, reach out to the manufacturer or seller for further investigation. An uncertified device doesn’t automatically indicate malware, but it merits closer scrutiny.
3. Keep Google Play Protect Enabled
Google Play Protect is built-in malware defense for Android. It scans for harmful app behavior and warns or removes known threats. However, it isn’t infallible, particularly against malware hidden deep within phone firmware.
To ensure it’s enabled: open the Google Play Store > your profile picture > Play Protect > Settings. Confirm that Scan apps with Play Protect is active. After that, return to the Play Protect screen to check for harmful applications. Although a clean scan is comforting, it doesn’t guarantee your device is malware-free, especially if the infection is embedded in its firmware. This is why strong antivirus software is recommended as an additional security measure.
4. Use Robust Antivirus Software
Reliable antivirus software adds another layer of security by watching out for suspicious activity and detecting threats that could slip past conventional measures. In fact, Bitdefender’s investigation commenced when its behavioral detection flagged an unusual system component.
This illustrates how monitoring app behaviors can uncover threats that ordinary scans may overlook. Even strong antivirus may identify malicious firmware without having the permissions to eradicate it.
5. Review Installed Applications and Sensitive Permissions
Navigate to Settings > Apps > See all apps or the related app list on your Android device. Keep an eye out for unrecognized applications, particularly those asking for unusual permissions.
Next, check Settings > Security & privacy > Privacy controls > Permission manager, whenever applicable. Pay attention to permissions like SMS access or others that are sensitive. Accessibility and notification access may even have separate settings pages.
Menu names vary based on the manufacturer and Android version. Proceed cautiously with unfamiliar apps that request extensive permissions. Still, avoid randomly disabling legitimate Android system components due to confusing technical names.
6. Observe for Uncommon Device Behavior
An infected smartphone might display signs such as unexpected mobile data usage, high background activity, unexpected ads, or apps appearing without your permission. Inspect Settings > Network & internet > SIMs > App data usage or its manufacturer equivalent for unusual data consumption. These symptoms can sometimes have benign explanations, and Midnight Mimosa may function without obvious signs. View unexpected actions as a reason to look deeper rather than as proof of an infection.
7. Be Cautious with Firmware Updates and Factory Resets
Make sure to install updates from your manufacturer’s verified support avenues. But if you suspect that the device firmware is compromised, consult the manufacturer prior to attempting any fixes. A factory reset typically removes personal user data and apps but might not replace corrupted software stored within the system partition.
Bitdefender suggests that eliminating Midnight Mimosa’s privileged component might call for firmware-level intervention or specialized tools like Android Debug Bridge. For many, manually changing system firmware can pose risks. If the manufacturer is unable to deliver a verified clean firmware image, replacing the device might be the safest option.
8. Secure Important Accounts If You Suspect Infection
If you think your phone has been compromised, use a separate trusted device to change crucial passwords, beginning with your primary email and financial accounts. Review recent activity and turn on multi-factor authentication wherever possible. It might be wise to utilize an authenticator app or passkeys on devices you trust rather than solely relying on SMS codes.
Bitdefender identified sensitive functions in the malware, including the possibility of accessing notifications and SMS messages. The researchers did not notice all capabilities actively being exploited, so it’s unwise to assume account compromise without solid evidence. Nevertheless, securing essential accounts is a wise move when you can no longer trust your device’s operating system.
Key Takeaways
I’ve always appreciated getting more for less, particularly regarding technology. There shouldn’t be a need to pay top dollar for a reliable device. However, this investigation highlights an issue that warrants significant attention from manufacturers of budget smartphones. When malware is embedded in the firmware, it leaves owners with little recourse. You might be cautious about what you download, scrutinizing permissions and adhering to security guidelines, yet still find yourself with a compromised device straight out of the box.
What worries me most is the potential for your phone to secretly generate income for others, using a data connection that you’re paying for. If eradicating the infection requires complicated firmware manipulation, the burden, unfortunately, falls on the buyer. Companies and marketplaces must assume greater responsibility for ensuring the software of their products is clean. A low price should never equate to accepting concealed software that jeopardizes your privacy and security.
Would you consider paying extra for a phone from a brand you trust, or do you feel manufacturers of budget devices should be held accountable when malware is preinstalled? Share your thoughts with us.
