Budget Android Phones Found With Unremovable Malware

Some low-cost Android phones sold through online marketplaces are reaching buyers with malware already built into the device firmware, according to Help Net Security. That matters for households because this is not a normal bad app you can delete; the malware is present before the phone is first turned on and can run with deep system privileges.

What happened

Help Net Security reports that Bitdefender found a campaign called Midnight Mimosa on budget Android phones from different brands using MediaTek platforms. The malware is installed in the firmware, which means it is part of the phone’s built-in software image and cannot be removed like a regular app.

According to the report, the malware can silently install and remove apps, grant permissions, and load code from a remote server. Bitdefender said the operators appear to use the infected phones for ad and click fraud, device and app data collection, and residential proxy relay nodes. That proxy use can turn a person’s phone into part of a larger network used by others.

The report says the malware sends device identifiers such as IMEI, Android ID, MAC address and timezone to its command-and-control server. It also gives itself Accessibility, Notification Access and SMS permissions. Bitdefender did not see those permissions used during its analysis, but Help Net Security notes they could allow access to on-screen activity, typed content, chat notifications, one-time codes, and text messages if abused.

Who is affected

The campaign was seen on thousands of devices in more than 150 countries, according to Help Net Security. The United States is listed among the countries with affected devices, after Mexico, France, Italy and alongside Germany, Brazil and Spain.

The report says some affected phones appear to be counterfeits that borrow names similar to high-end models. Listed model strings include “i17 Pro Max,” “S25 Ultra,” “S24 Ultra” and “Note 18 Ultra.” Some devices that are not made by Samsung reportedly identify themselves using the Galaxy S25 Ultra model code SM-S938B.

Help Net Security says the two most common models seen among infected devices were the Doogee S200 X and Cubot KINGKONG X. The affected model list may not be complete, and the source does not disclose a firmware patch or official cleanup method.

What to do now

1. Check the phone’s exact model in Settings > About phone. Be cautious if a cheap device claims to be a flagship model or shows a model name that does not match the brand printed on the phone.

2. Review special permissions under Settings > Apps > Special app access. Look for unknown apps with Accessibility, Notification Access or SMS permissions, especially apps labeled only as “System” or apps with no icon.

3. If suspicious apps keep returning after you remove them, stop using that phone for banking, email, password resets, work accounts, or two-factor authentication codes. Help Net Security reports that owners of some Cubot and Doogee phones saw suspicious apps reinstall themselves.

4. Move important accounts to a known-good device. Change passwords for accounts used on the suspect phone, starting with email, banking, shopping and social media. Turn on two-factor authentication from a clean device.

5. Do not rely on a factory reset as a guaranteed fix. Because the malware is reported to be in firmware and cannot be uninstalled, the safer move is to replace the phone with a device from a trusted retail channel.

6. When buying a low-cost Android phone online, avoid listings that mimic famous flagship names, use vague branding, or advertise specs that seem unrealistic for the price. Choose sellers with clear return policies and recognizable manufacturer support.

How to protect your home network

If you have smart devices, spare phones, cameras or tablets from unknown brands, keep them off your main WiFi when possible. CyberSec24’s guest WiFi setup guide and smart device network guide explain how to separate risky devices from laptops, phones and work machines.