Cheap Android phones found with malware already installed

Bitdefender researchers found a malware campaign called Midnight Mimosa pre-installed in the firmware of some low-cost Android phones. Because it is embedded in system software, it can gain elevated access, install or remove apps and download further code, while a normal uninstall may not remove the infection.

Bitdefender observed infections on thousands of devices across more than 150 countries over about two years, including in the United States. Some infected phones reported names linked to Doogee and Cubot models, while others used counterfeit or misleading Samsung and Apple model identifiers. The findings do not show that every phone sold under those names is affected, or establish that the manufacturer linked to firmware certificates was responsible.