Some Budget Android Phones Arrive With Malware Already Installed

Buying a new phone should mean starting with a clean device. But researchers have discovered that some inexpensive Android phones come with malware built into their software before customers even turn them on.

Bitdefender identified the campaign as Midnight Mimosa. It affects certain low-cost Android devices using MediaTek hardware. The malware hides inside the phone’s firmware—the underlying software that helps run the device—and has enough access to install apps, change permissions, and run downloaded code without asking the owner.

Much of the activity revolves around making money through fake advertising views and clicks. The malware installs apps disguised as everyday tools, including weather apps and file managers, then uses them to generate advertising activity behind the scenes.

Another concern is its ability to turn infected phones into residential proxies. That means someone else’s internet traffic could pass through the owner’s connection, helping hide where that traffic actually originated. Researchers confirmed that the controlling infrastructure accepted device registrations, but their test device received no instructions to relay traffic. Active forwarding was therefore not confirmed during that test.

Removing the infection is difficult because it operates as a system component. Deleting an ordinary app won’t remove the underlying malware. Researchers say cleanup can require work on the firmware or disabling the malicious component through Android debugging tools.

It remains unclear who added the malware or where the tampering happened in the supply chain. These findings concern affected devices; they do not establish that every budget Android phone or every MediaTek device is infected.

My take: the troubling part is that users don’t have to click a bad link or download a suspicious app. In these cases, the problem arrives with the phone.

Source: Original reporting by Lawrence Abrams at BleepingComputer.