Budget Android Phones Ship With Malware Built In

The Phone Is Infected Before The Box Is Opened

On 8 October Bitdefender Labs reported a campaign it calls Midnight Mimosa, running on low-cost, multi-brand Android phones built on MediaTek platforms. The malware ships in the device firmware, so it is on the phone before the owner switches it on for the first time, and the owner cannot uninstall it.

Its main component, a system package called com.android.system.lite, runs with system-level privileges. That lets it silently install and remove apps, grant permissions and load code supplied remotely by its operators. Bitdefender found the same core under other system-sounding names, including com.android.sys.prot, com.android.sys.gmsprot and com.android.sys.bcprot.

The money comes from fraud and from renting the phone out. The operators run ad and click fraud, collect device and app data and turn phones into residential-proxy relay nodes in botnets. The system app does not click ads itself: dropped cover apps such as weather, app-lock and OCR tools load genuine ads through a legitimate ad SDK in an invisible window.

How Far It Has Spread

Bitdefender's counts describe a campaign with global reach and a heavy European presence.

No single country dominates. Bitdefender reads the two centres of gravity, Western Europe and the Americas, as what hardware moving through international online marketplaces looks like, not as a regional distribution channel. The Hacker News's list of countries also includes the UK, Canada, Romania, Poland and Thailand.

Bitdefender cannot say where in the supply chain the malware is added. It could be a contract manufacturer, a firmware integrator, a logistics partner or someone further down the chain.

Why The Usual Controls Do Not Apply

Bitdefender's point is that every user-facing defence assumes the owner is present at installation: the install prompt, the store review, Play Protect and the ability to uninstall afterwards. A platform-signed system app removes the owner from that loop, and this one disables Google Play just before installing a payload and re-enables it afterwards.

Clearing an affected phone needs firmware-level cleanup or disabling the component over ADB, and Bitdefender calls neither realistic for most owners. It says the durable fix sits with the vendors and marketplaces that ship and sell the firmware. Our reading is that a mobile-management agent runs on top of the same firmware, so it should not be trusted to remove a component that lives in the system partition.

EU rules aim at the manufacturer, but the timing leaves buyers exposed. The Cyber Resilience Act's reporting duties for actively exploited vulnerabilities have applied since 11 September 2026, and its main obligations apply from 11 December 2027. Bitdefender does not say whether the phones it found were sold in the EU through legitimate channels, only that detections are heavy in France, Italy, Germany and Spain.

What To Put In Your Phone Policy

Write a procurement standard: named brands, a published security-update period and phones bought from the manufacturer or an authorised reseller. Treat very cheap flagship lookalikes as a red flag. Bitdefender notes that model names such as S24 Ultra, S25 Ultra and S26 Ultra appear as model strings reported by low-cost MediaTek hardware.

For staff who bring their own phones, allow approved models only and let unknown budget devices reach guest Wi-Fi at most. If your DNS or firewall logs are searchable, look for the command and payload hosts in Bitdefender's indicator list, api.weatherlive[.]world and oss.showtimetool[.]com, and treat a hit as a reason to inspect that device.

A package name is a hint, not a test. Bitdefender stresses that the names rotate and that the shared core is what matters, so rely on hardware you chose and logs you can read, not on a blocklist of app names.

Read next: Google Just Helped Fund the Lock-In UALink Was Built to Beat  |  Motorola Ends GrapheneOS's Ten-Year Pixel Monopoly