Cheap Android phones shipped with untouchable malware

A recent Bitdefender investigation has confirmed that inexpensive Android smartphones sold on online marketplaces are being delivered with malware already embedded in the firmware, and the malicious code cannot be removed by the user.

The campaign, identified as “Midnight Mimosa,” targets budget devices that run on MediaTek processors and are offered by several unnamed manufacturers. The malicious software is installed before the buyer powers on the phone for the first time, making it part of the device’s core system rather than an ordinary app. Because it resides in the firmware, standard uninstall methods do not work.

Consumers who purchase these low‑priced phones are the primary victims. The devices appear legitimate, but the hidden malware can harvest personal data, track activity, and potentially download additional unwanted programs. The threat is not limited to a single brand; any budget Android phone using the specified hardware platform could be affected.

Bitdefender recommends that buyers verify the origin of any cheap Android handset and avoid purchasing from unverified sellers. If a device is already in hand, users should check for unusual behavior such as unexpected data usage or unknown apps appearing in system settings. Running a reputable mobile security scanner can help detect the presence of the hidden code, though removal may require flashing a clean firmware image, a process that many users are not equipped to perform.

For those who suspect their phone is compromised, the safest course is to back up essential data, perform a factory reset, and then reinstall the operating system from an official source. When possible, choose phones from reputable manufacturers and buy from authorized retailers.

ComputerScams.com offers free tools that can assist with related security checks, such as its password strength checker and email checker, to help protect personal information after a device may have been exposed.

A practical step you can take right now is to review the permissions of all installed apps and revoke any that request access unrelated to their function.

Source: Read the original report