Cheap Android Phones Sold with Malware Pre-Installed
Cheap Android phones have been sold with malware already installed on them. Security firm Bitdefender announced on the 23rd (local time) that it had discovered this malware campaign, dubbed 'Midnight Mimosa.' The malware cannot be stopped simply by being careful about installing programs, as it resides on the phone before it is even powered on. This case shows that security threats can exist even when purchasing a new phone — if users receive an already-infected device, it is difficult to avoid no matter how cautious they are.
According to Bitdefender's investigation, the malware was found on low-cost Android devices from multiple brands that use MediaTek chipsets. The malicious apps were embedded in the system software and operated with elevated privileges that ordinary apps cannot obtain. With these privileges, the malware can install additional apps without user consent, remove existing apps, and grant sensitive access permissions to other software. It can also download and execute new code from remote servers.
The researchers identified several versions hidden behind package names such as com.android.system.lite and com.android.sys.prot, which appear to be legitimate system components. Removal is also difficult: because the malware is embedded in the system partition, standard removal methods cannot eliminate the underlying infection.
The researchers also found the related malicious apps on Google Play, and the campaign was confirmed to have reached users in the United States as well. The findings were published through Fox News' CyberGuy Report on October 23, 2026.
