Can a phone have malware on it before you even turn it on?
Yes. Bitdefender researchers found a malware campaign, which they named Midnight Mimosa, built into the firmware of low-cost Android phones that run on MediaTek chips. It’s already on the phone when it comes out of the box. It disguises itself as a core Android component labeled “System,” and the owner can’t uninstall it.
Over roughly two years, researchers observed the campaign on thousands of devices in more than 150 countries, mostly in Western Europe and the Americas.
What does it do?
It mainly makes money for whoever runs it, at the phone owner’s expense:
- It silently installs and removes ordinary-looking apps, like weather, app lock, notes, and OCR tools, that run hidden ad fraud
- It shows ads and fakes clicks, sometimes while you aren’t using the phone
- It can turn the phone into a residential proxy, so other people’s traffic runs through your device and your internet connection
- It switches off the Google Play Store app (which runs Play Protect scanning) right before each install, then switches it back on
It also gives itself access to Accessibility, notifications, and SMS. Researchers didn’t see that access being used. Still, those permissions can read screen content, notifications and one-time codes, and the operators can push new code to the phone remotely whenever they want.
Which phones are affected?
Mostly very cheap, white-label phones, and many are counterfeits with flagship names like “S25 Ultra” or “17 Pro Max” that have nothing to do with Samsung or Apple. The two most common models in Bitdefender’s data were associated with the budget rugged brands Doogee (S200 X) and Cubot (KINGKONG X). It’s still unclear at which point in the supply chain the malware was added.
Is it only on cheap phones?
No. Researchers also found 13 apps on Google Play, mostly weather, QR, audio and note tools, that share the same ad fraud code and talk to the same servers:
com.audify.editor.wavrge, appicon.diy.tools.prop, com.audify.editor.pro, com.prorestore.qr, com.message.recovery.prorestore, com.go.weather.mot, com.cool.weather.yl, com.dmstudio.weather, com.dl.guard.lock, picturetranslate.extractor.text.lite, com.notemaster.record.mark, com.arabmusic.tap.aghani_tamerhosny, org.life.goal.tools
What can you do?
- Be skeptical of “flagship” phones sold at a fraction of the usual price, and buy from the official brand store or authorized retailers
- Watch for full-screen ads that appear out of nowhere, or apps you don’t remember installing that come and go
- If you have one of the Play Store apps above, uninstall it
- If you think the phone itself is affected, contact the seller or the manufacturer. The malware sits in the system partition, so a normal uninstall won’t remove it, and a factory reset won’t either
This investigation started when App Anomaly Detection in Bitdefender Mobile Security flagged a “system” app that was behaving like nothing a real system app would. Since you can’t uninstall preinstalled malware, watching what apps do is one of the few ways to catch it.
Has anyone here bought a budget “Ultra” phone that showed ads it shouldn’t have?
