Malware Found Pre-Installed In Thousands Of Budget Android Phones - Here's What We Know

When it comes to budget and midrange Android phones, you have a plethora of choices. What you should think twice about, though, is picking one up for extremely cheap from a no-name brand. Digital security research firm Bitdefender has detailed malware that's been shipped on generic knock-off smartphones. The malware generates revenue for its creator by inserting legitimate ads into installed apps, and through hiding fraudulent ad behavior beneath the surface. The malware also leaves exploitable pathways open for other hackers to take control of those devices.

What we know about this campaign, which Bitdefender has dubbed "Midnight Mimosa," is that the malware ships as part of the device's built-in firmware for devices with low-power MediaTek chipsets. The phones are typically sold under a variety of labels from Cubot and Doogee to counterfeits of popular series including Samsung's Galaxy S24, S25, and S26. 

Bitdefender said "Midnight Mimosa" adds an app simply called "System" with a package name of com.android.system.lite to the device. The malware is a fully-privileged process that cycles downloads and deletions of innocuous sounding weather, app-lock, and other utility apps on and off the phone. These apps provide a proxy for the malware to present full-screen and invisible ads to the user, even if they never opened those apps. The malware is written in ways designed to conceal the scheme from the user and bypass security scans.

The cybersecurity firm said thousands of devices have been tracked with this malware over 2024 and 2025, though even more are likely affected. 13% of those devices were profiled for Mexico, making it the most-affected country. The United States was fourth on the list at 8% while Canada was ninth at under 3%. The researchers also said they couldn't identify where in the supply chain this malware was introduced, whether at the device manufacturer, the firmware supplier, the integrating brand, or anywhere else in transport. One clue is that signatures in the payload apps trace back to a single source, Android ODM Shenzhen Zediel.

Malware campaigns have plagued the gray market in Android phones for a while. U.S.-based ODM Blu caught flack from the FTC in 2018 for allowing its firmware contractor to collect data, text, and call logs of its users. In a separate 2016 incident, another firmware contractor, Ragentek, deployed an updater binary that could have been commandeered by an unauthorized party as it called upon two unregistered web domains. Millions of phones from Blu, Infinix, Doogee, Xolo, and other brands were affected. Similar stakes are present in the Midnight Mimosa campaign as the malware could be made to install apps outside of the ad fraud scheme, including to participate in bot swarms and DDoS attacks.

The payload apps attributed to Shenzhen Zediel have been around for a while, but it's only one vector of the scheme. 13 other apps with similar ad fraud-related code and signed by the same company have been published on the Google Play Store, Bitdefender researchers said. This means that they were on the open marketplace and able to target everyday people without a previously-hacked device. These apps have since been taken off of the store, the researchers said.

Google, Motorola, and Samsung are by no means perfect—there was a major security flaw for Pixel phones found a few years back—but they all have security processes to protect their firmware, including how they're updated and how they'll respond to you, the owner, if something goes wrong.