Pre‑baked Android firmware malware spreads to budget phones

A new malware campaign named Midnight Mimosa has been discovered preinstalled on inexpensive Android smartphones sold in more than 150 countries. Security researchers say the malicious firmware is embedded in the devices before they reach consumers, allowing the code to run without any user interaction.

The affected devices are budget models from several manufacturers that are marketed primarily to cost‑conscious buyers. The malware resides in the phone’s firmware, the low‑level software that controls hardware functions, and can silently collect personal data, display unwanted ads, and potentially download additional malicious payloads. Because the code is part of the firmware, it survives factory resets and cannot be removed by typical user actions.

According to the report, the campaign appears to target users who are less likely to scrutinize the origin of their devices or apply regular security updates. The malware’s presence was confirmed through analysis of dozens of units purchased from online marketplaces and local retailers. Researchers observed that the code activates shortly after the device boots, establishing a connection to remote servers that can be used to exfiltrate contacts, messages, and location data.

For consumers who already own a suspect device, the safest course is to avoid entering sensitive information such as passwords or banking details until the phone can be verified as clean. Installing a reputable mobile security app can help detect unusual activity, but it may not remove firmware‑level infections. If possible, flash the device with a known clean firmware image from the official manufacturer, or return the phone for a replacement. Users should also consider using a secondary device for sensitive tasks until the risk is mitigated.

General protection steps include buying phones only from authorized retailers, checking that the device runs the latest official Android version, and enabling automatic updates. When setting up a new phone, avoid granting unnecessary permissions to apps and use strong, unique passwords for all accounts. Free tools on ComputerScams.com, such as the password strength checker, can help ensure your credentials are robust.

A practical tip: before logging into any account on a new or low‑cost Android phone, verify that the device’s software is up to date and that no unknown apps have been preinstalled. This simple check can stop many malicious campaigns before they gain a foothold.

Source: Read the original report