Preinstalled Android Malware Infects Budget Android Devices in More Than 150 Countries

A widespread malware campaign is targeting low-cost Android devices with malicious software embedded directly into their firmware before the devices reach consumers. The campaign, identified as Midnight Mimosa, has affected thousands of devices across more than 150 countries, raising concerns about security risks associated with inexpensive smartphones and other Android-based products.

Cybersecurity researchers at Bitdefender discovered the campaign and reported that the malware provides attackers with extensive control over infected devices. Unlike conventional malicious applications that users can uninstall, this malware operates as a persistent system application, making it significantly more difficult to remove.

Malware Embedded Before Devices Reach Consumers

The campaign primarily affects low-cost Android devices built on MediaTek platforms. By incorporating malicious software into device firmware before sale, attackers can compromise devices without requiring users to download a suspicious application or click a malicious link.

Once an affected device is switched on, the malware can begin operating in the background. Because it has system-level privileges, it can silently install or remove applications, grant permissions, and execute additional code supplied by remote operators.

The malware’s privileged position also makes ordinary removal procedures ineffective, leaving users exposed even if they recognize suspicious activity.

Ad Fraud and Botnet Operations

Researchers identified advertising fraud as one of the campaign’s principal objectives. Infected devices can generate fraudulent advertising interactions, allowing attackers to profit from automated clicks and other deceptive activities.

The compromised devices can also become part of a larger botnet. Criminal operators may use such networks for their own operations or make access to the infected devices available to other threat actors.

The malware’s remote management capabilities allow attackers to change its behavior, install additional components, and adapt compromised devices to different purposes.

The campaign also involves proxy-network abuse, potentially allowing third parties to route internet traffic through infected devices.

Malware Activity Extends Beyond Device Firmware

Bitdefender also identified 13 applications distributed through Google Play that contained code associated with the Midnight Mimosa campaign. These applications were published under two developer accounts and used separate signing certificates.

Although the applications did not possess the same privileged access as malware embedded in firmware, they provided an additional distribution channel for related malicious code.

Researchers found that the malware could temporarily disable Google Play Store functionality while installing additional malicious applications, then reactivate it afterward. This behavior may help attackers reduce the likelihood of detection by Google Play Protect during the installation process.

The findings demonstrate that the campaign is not limited to compromised manufacturing or distribution processes.

Global Distribution and Geographic Reach

Over approximately two years of monitoring, researchers observed thousands of unique affected devices across more than 150 countries.

Mexico and France recorded the highest numbers of observed infections, followed by Italy, the United States, Germany, Brazil, and Spain. Western Europe and the Americas were particularly prominent in the reported distribution.

The geographic spread indicates that the campaign is not confined to a single country or region.

However, the available research did not establish the total financial profits generated by the operators.

Security Risks for Android Users

The campaign highlights the importance of supply-chain security, particularly in the market for low-cost electronic devices.

Because the malware can be integrated before a device reaches its owner, conventional precautions such as avoiding suspicious links may not prevent infection.

Consumers should prioritize reputable manufacturers and trusted retailers, install available security updates, and review unexpected applications and device behavior. Organizations managing Android fleets should also evaluate device provenance and consider whether their security controls can identify unauthorized system components.

Devices suspected of containing firmware-level malware may require manufacturer-supported firmware replacement or other remediation beyond ordinary application removal.

Conclusion

The Midnight Mimosa campaign demonstrates how attackers can exploit the Android device supply chain to establish persistent control over inexpensive smartphones and related products.

With thousands of affected devices observed across more than 150 countries, the campaign combines preinstalled malware, advertising fraud, proxy abuse, and botnet capabilities.

The discovery of related applications on Google Play further illustrates how attackers can use multiple distribution channels. Protecting consumers will require stronger supply-chain safeguards, better device verification, and continued monitoring for malware that operates below the application level.