Thousands of low-cost Android devices across more than 150 countries may have been shipped with malware embedded in their firmware, raising concerns about security risks associated with inexpensive smartphones.<\/p>\n
Cybersecurity researchers at Bitdefender identified a campaign dubbed Midnight Mimosa, which can allow malicious software to operate on affected devices before users install any applications themselves.<\/p>\n
The campaign was observed over two years across thousands of unique devices. Mexico, France, Italy, the United States and Germany had the highest numbers of affected devices, according to the researchers.<\/p>\n
The malware has been found in some Android devices powered by MediaTek chips, including phones marketed under misleading names that suggest flagship-level specifications.<\/p>\n
What can the malware do?<\/p>\n
The malicious software can secretly install and remove apps, give them access to phone features, generate fake advertising activity and run harmful code, Bitdefender said.<\/p>\n
Some affected devices can also be used to route other people’s internet traffic through their connections without their owners’ knowledge. Such devices may become part of a botnet \u2014 a group of infected devices that criminals can control remotely.<\/p>\n
The researchers also identified 13 malicious apps distributed through Google Play. The preinstalled malware could temporarily disable the Google Play Store, allowing it to install other harmful apps while attempting to avoid detection by Google Play Protect, Google’s built-in security system.<\/p>\n
The malware can also secretly install at least 32 different apps disguised as legitimate tools, including app lockers, weather apps, file managers, icon customisers, text-scanning tools and audio editors, researchers said.<\/p>\n
Removing the malware is difficult<\/p>\n
Unlike applications that users can uninstall through their phone’s settings, the malware is embedded in the device firmware, making it harder to remove.<\/p>\n
Bitdefender said cleaning an affected device requires firmware-level cleanup or disabling the component through Android Debug Bridge (ADB), a technical tool used to communicate with Android devices. Neither option is practical for most users, the researchers said.<\/p>\n
\u201cThe durable fix sits with the vendors and the marketplaces that ship and sell the affected firmware,\u201d they added.<\/p>\n
Researchers have not identified who is behind the campaign. They also do not know at what stage of manufacturing or distribution the devices became infected.<\/p>\n
Some affected software was signed with digital certificates associated with Shenzhen Zediel, which appears to be Zedi Technology, a Chinese company that designs smart hardware and motherboards. However, researchers could not establish whether the company was involved in the campaign or knew about the malware.<\/p>\n
\u201cHow these certificates ended up on those phones \u2014 and whether the certificate owner was involved in or aware of the malware deployment \u2014 remains unclear,\u201d the researchers said.<\/p>\n
Researchers also found malware on devices using fake flagship phone names linked to Apple, Samsung and Honor. Some devices carried misleading model names, making their manufacturers difficult to identify. Affected models included some associated with Chinese brands Doogee and Cubot. Researchers have not identified who installed the malware.<\/p>\n
How to spot and respond<\/p>\n
Preinstalled malware can be difficult to detect, but warning signs include unexplained ads, unfamiliar apps, unusual battery drain, excessive data use and frequent overheating. These symptoms do not necessarily indicate an infection, but users should check their apps, update Android and run a reputable mobile-security scan if their phones behave unexpectedly.<\/p>\n
Because Midnight Mimosa is embedded in the device’s system software, a factory reset may not remove it, according to Bitdefender.<\/p>\n
Users who suspect their phones are infected should avoid sensitive activities such as mobile banking and contact the seller or manufacturer about a refund or replacement. Buying from reputable brands and authorised retailers can also reduce the risk of purchasing a compromised device.<\/p>\n
Warning signs for buyers<\/p>\n
Bitdefender said inexpensive Android devices are not necessarily unsafe. However, buyers should be cautious when a phone is advertised at an unusually low price, sold by an unknown retailer or listed without clear information about its manufacturer.<\/p>\n
The researchers warned that a phone advertised with the features of a current flagship model at a fraction of the usual price could warrant closer scrutiny.<\/p>\n
Back in March 2025, another cyberthreat, the BADBOX 2.0 botnet, was reported to have infected more than one million consumer devices worldwide, including low-cost, off-brand devices with preinstalled malware.<\/p>\n","protected":false},"excerpt":{"rendered":"Thousands of low-cost Android devices across more than 150 countries may have been shipped with malware embedded in…\n","protected":false},"author":2,"featured_media":630748,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16],"tags":[309225,309240,309218,309221,109817,309229,309233,309245,309217,309226,309219,309246,309231,309223,309239,309237,309241,309236,309238,309228,309216,309227,309244,309222,309215,342,309232,309247,309242,111,139,69,309214,309220,309235,309224,309234,309230,309243,145],"class_list":["post-630747","post","type-post","status-publish","format-standard","has-post-thumbnail","category-mobile","tag-android-botnet","tag-android-device-security","tag-android-devices-infected-with-malware","tag-android-firmware-malware","tag-android-malware","tag-android-malware-detection","tag-android-malware-removal","tag-android-privacy-risks","tag-android-security-threat","tag-badbox-2-0-botnet","tag-bitdefender-malware-report","tag-budget-smartphone-security","tag-cheap-android-phone-malware","tag-counterfeit-android-phones","tag-counterfeit-iphone-models","tag-cubot-smartphone-security","tag-cybersecurity-research","tag-doogee-smartphone-security","tag-fake-samsung-phones","tag-google-play-protect","tag-low-cost-android-phones","tag-malicious-apps-on-google-play","tag-malware-embedded-in-firmware","tag-mediatek-android-malware","tag-midnight-mimosa-malware","tag-mobile","tag-mobile-cybersecurity-threats","tag-mobile-device-malware-2026","tag-mobile-malware-campaign","tag-new-zealand","tag-newzealand","tag-nz","tag-preinstalled-android-malware","tag-preinstalled-malware-on-smartphones","tag-shenzhen-zediel-malware","tag-smartphone-cybersecurity","tag-smartphone-firmware-security","tag-smartphone-security-risks","tag-smartphone-supply-chain-security","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/630747","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=630747"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/630747\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/630748"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=630747"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=630747"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=630747"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}