Cheap Android phones found with malware already installed

Buying a cheap smartphone can feel like a smart move. After all, why spend hundreds more when a phone promises a big screen, decent cameras and all the Android apps you use every day? But what if that bargain phone came with a hidden surprise that was already hiding inside the device when you bought it?

Security researchers at Bitdefender have uncovered a malware campaign called Midnight Mimosa that infects certain low-cost Android devices before their owners even turn them on.

The malicious software hides inside the phone's firmware, giving attackers powerful access that ordinary apps never receive. Even more concerning, researchers found related malicious apps on Google Play. And this problem has reached the United States.

ANDROID MALWARE CAN STEAL YOUR PIN AND BANK LOGINS

Join our upcoming CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money

In this free live online class, Kurt "CyberGuy" Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season. You’ll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.

Join us Saturday, Oct. 31, at 11 AM ET/ 8 AM PT. Register free now at CyberGuyLive.com.

Most smartphone security advice starts with being careful about what you download. That makes sense when a malicious app tricks you into installing it. Midnight Mimosa changes that equation because the infection can arrive with the phone itself. According to Bitdefender's investigation, the malware was discovered on low-cost, multi-brand Android devices built around MediaTek chipsets. Researchers found malicious applications embedded in the system software, where they could operate with elevated privileges.

These privileges allow the malware to install additional apps without permission, remove existing applications and grant sensitive access to other software. It can also download and execute new code from remote servers. The researchers identified several versions hiding behind innocent-looking Android package names, including com.android.system.lite, com.android.sys.prot and com.android.sys.gmsprot.

To most phone owners, those names would look like technical components that belong there. That's exactly what makes the scheme so difficult to spot. And because the malicious software lives in the system partition, a normal uninstall won't remove the underlying infection.

Bitdefender says it observed Midnight Mimosa on thousands of unique devices across more than 150 countries over approximately two years. Mexico, France and Italy had the highest observed numbers, followed by the United States, Germany, Brazil and Spain. Researchers also observed infected devices reporting model names associated with Doogee's S200 X and Cubot's KINGKONG X. 

However, the findings do not establish that every phone sold under those names is affected. Some devices in the campaign use misleading or counterfeit model identifiers, making it difficult to identify infections based on a phone's reported name alone.

Another part of the investigation uncovered devices pretending to be expensive smartphones. Some reported names resembling Samsung Galaxy flagship models, while others imitated Apple's iPhone naming. In other words, a phone advertised as a premium Samsung or Apple device might actually contain inexpensive Android hardware running modified software.

Researchers found that some counterfeit devices even reported legitimate looking Samsung model identifiers. That makes checking the model name alone an unreliable way to confirm authenticity. The investigation also identified firmware signed with certificates associated with Shenzhen Zediel, a Chinese device manufacturer. However, Bitdefender emphasized that this does not establish that the company created the malware or knew about its presence. Exactly where the malicious code entered the manufacturing and distribution process remains unknown.

You might expect malware this powerful to steal passwords immediately or display obvious warnings. Instead, Midnight Mimosa appears primarily designed to generate money for its operators while staying out of sight. One way it earns money is through advertising fraud. The malicious system component silently installs apps that look like weather tools, app lockers and other everyday utilities.

Those apps can display legitimate advertisements in hidden windows or generate clicks without the owner touching the screen. Advertisers may end up paying for activity that never came from a real person. Bitdefender identified at least 32 unique disguised applications involved in the broader operation. The malware can also repeatedly install and remove these apps, making them harder to notice during a casual check of the phone.

The advertising fraud is only part of the story. Researchers also discovered software that can turn infected phones into residential proxy servers. Here's what that means. Someone operating the malware could route internet traffic through your phone's connection. To websites and online services, that traffic may appear to come from your home or mobile network rather than the person actually controlling it.

Such connections can be valuable to cybercriminals because they help conceal where online activity originates. The same infrastructure could potentially support larger botnet operations or distributed denial-of-service attacks. Bitdefender confirmed that the malware contained the technology needed to turn infected phones into residential proxy servers. 

However, the researchers later clarified that one server they reached was actually a sinkhole, a system used to intercept malicious communications. Their testing did not demonstrate active traffic being relayed through the infected device. The underlying capability remains concerning because it could allow operators to route traffic through a phone owner's connection.

AI MALWARE CAN REWRITE ITSELF TO EVADE DETECTION

One particularly troubling finding involves how Midnight Mimosa avoids security checks. Before installing certain malicious apps, Midnight Mimosa temporarily disables the Google Play Store app. Bitdefender believes this helps the malware avoid detection by Google Play Protect during installation. 

Once the process finishes, the malware re-enables the Store, reducing the chances that the phone owner will notice anything unusual. The process happens without the phone owner's involvement.

Some versions also manipulate Android's installer records to make applications appear to have come from Google Play, even when the malware installed them directly. So a quick look at where an app supposedly originated may not tell the whole story.

Wavrge, App Icon DIY, Audify, QR Pocket, All Deleted Messages Recovery, WeatherGo, CoolWeather, Daily Weather, Lock & Hide, QuickText Extractor, NoteMaster, Tap to Translate and Tasky. These apps offered functions such as weather forecasts, QR scanning, message recovery and audio editing. 

However, researchers found that they could also generate unwanted advertising activity, including displaying ads outside their normal interfaces. Unlike the malware embedded in phone firmware, these Google Play apps lacked the elevated system privileges needed to silently install other applications. The apps were associated with 13 different signing certificates and at least two developer accounts, identified as fivedev and CPS Developer.

Are these apps still on Google Play? Checks of the Google Play listings for all 13 apps found that none were available for download. However, it remains unclear whether Google removed the apps or their developers withdrew them. CyberGuy reached out to Google for comment but did not receive a response before our deadline.

What should you do if you recognize one? Check your Android phone's installed apps. If you find one of these applications, verify that its package identifier matches the one listed in Bitdefender's report before uninstalling it. Different apps can share similar names. Even when an app disappears from Google Play, it can remain installed on your phone. The findings show why downloading an app from an official store doesn't automatically guarantee its safety.

The findings also connect with complaints posted by some Doogee and Cubot smartphone owners on the XDA forums. Users described suspicious system applications that reappeared after attempts to remove them. One Doogee Fire 3 Max owner reported that an official firmware update introduced the infection. According to that account, reverting to an older firmware version removed the problem, while reinstalling the newer update brought it back.

Other forum participants reported that subsequent firmware updates resolved their infections. However, Bitdefender identified one of the suspicious packages discussed in the forum, com.android.non.szcz, as belonging to the same malware family. That creates a frustrating situation for owners. A software update is normally something I encourage people to install for better security. But when the firmware itself is compromised, the source and integrity of the update become especially important.

The most effective protection starts before you buy a device. However, there are useful precautions if you already own an inexpensive Android phone or suspect something unusual is happening.

Be especially careful with unusually cheap smartphones advertised as premium models. Counterfeit devices can copy familiar names and appearances while using entirely different hardware. Choose established retailers and authorized sellers when possible. 

Check the manufacturer's official website to confirm that the model exists and matches the advertised specifications. An extremely low price deserves a closer look, especially when the seller provides limited information about software updates or warranty support.

ANTI-SCAM SETTINGS ON IPHONE, PIXEL AND GALAXY YOU SHOULD CHECK

Before trusting an unfamiliar Android phone, check whether Google recognizes it as a certified device. Play Protect certification indicates that a device has met Google's compatibility requirements. However, certification alone cannot guarantee that its firmware is free of malware.

Here's how to check:

If your phone says Device is not certified, contact the manufacturer or seller to investigate. An uncertified device does not automatically mean it contains malware, but it deserves additional scrutiny.

Google Play Protect is Android's built-in malware protection. It scans apps for harmful behavior and can warn you about or remove known threats. However, it is not 100% effective at detecting every malicious app, especially malware hidden deep within a phone's system software.

To check it, open the Google Play Store > your profile picture > Play Protect > Settings. Make sure Scan apps with Play Protect is enabled. Then return to the Play Protect screen to check for harmful apps. A clean scan is reassuring, but it does not guarantee your phone is free of malware, particularly if the infection is embedded in its firmware. That's why we also recommend strong antivirus software as an additional layer of protection.

Strong antivirus software adds another layer of protection by monitoring suspicious behavior and detecting threats that may go unnoticed. In fact, Bitdefender's investigation began when its behavioral detection technology flagged an unusual system component. 

This shows why monitoring how apps behave can help uncover threats that traditional scans might miss. However, even strong antivirus software may detect malicious firmware without having the permissions needed to remove it. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.

Open Settings > Apps > See all apps or the equivalent app list on your Android device. Look for applications you don't recognize, especially ones requesting unusual access.

Next, review Settings > Security & privacy > Privacy controls > Permission manager, where available. Check permissions such as SMS access and other sensitive capabilities. Accessibility and notification access may have their own settings pages.

Menu names vary by manufacturer and Android version. Be cautious about unfamiliar apps with extensive permissions. However, don't randomly disable legitimate Android system components because their technical names look strange.

An infected phone may show signs such as unexplained mobile data usage, excessive background activity, unexpected advertisements or apps appearing without your permission. Check Settings > Network & internet > SIMs > App data usage, or your manufacturer's equivalent, to investigate unusual data consumption. These symptoms can have harmless explanations, and Midnight Mimosa may operate without obvious warning signs. Treat unexpected activity as a reason to investigate rather than proof of infection.

Install updates supplied through your manufacturer's verified support channels. However, if you suspect the device firmware itself is infected, contact the manufacturer before attempting a repair. A factory reset generally removes personal data and user-installed apps. It does not necessarily replace compromised software stored in the system partition.

Bitdefender says removing Midnight Mimosa's privileged component may require firmware-level cleanup or specialized tools such as Android Debug Bridge. For most people, manually modifying system firmware introduces additional risks. If the manufacturer cannot provide a verified clean firmware image, replacing the device may be the safest practical option.

If you believe your phone has been compromised, use a separate trusted device to change important passwords, starting with your primary email and financial accounts. Review recent account activity and enable multifactor authentication where available. Consider using an authenticator app or passkeys on a trusted device rather than relying exclusively on SMS codes.

Bitdefender identified sensitive capabilities in the malware, including potential access to notifications and SMS messages. The researchers did not observe every capability being actively exploited, so account compromise should not be assumed without evidence. Nevertheless, protecting important accounts is a sensible precaution when you can no longer trust the phone's operating system.

I've always liked the idea of getting more for less, especially when it comes to technology. You shouldn't have to spend flagship phone money to get a device that works reliably. But this investigation exposes a problem that deserves far more attention from the companies making and selling inexpensive smartphones. When malware arrives embedded in the firmware, the owner has very little control. You can be careful about downloads, check permissions and follow security advice, yet still end up with a compromised device straight out of the box. 

What concerns me most is the possibility that your phone could be quietly earning money for someone else while using a connection you pay for. And if removing the infection requires specialized firmware work, the burden lands on the person who bought the device. Manufacturers and marketplaces need to take greater responsibility for verifying the software that ships on the products they sell. A low price should never mean accepting hidden software that puts your privacy and security at risk.

Would you pay more for a smartphone from a manufacturer you trust, or do you think companies selling budget phones should be held legally responsible when malware comes preinstalled? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Newsletter

Copyright 2026 CyberGuy.com. All rights reserved.