Pre‑installed Malware Found on Inexpensive Android Phones Spreads Across More Than 150 Nations

Security researchers have identified a widespread campaign, dubbed Midnight Mimosa, that embeds malicious code into the firmware of low‑cost Android smartphones before they reach consumers. The infection appears on devices sold in more than 150 countries, affecting a sizable portion of the global market for budget phones.

The hidden payload operates at the system level, granting persistent access that can be used to harvest personal data, display unauthorized advertisements, and potentially download additional malicious modules. Because the code resides in the firmware rather than a regular app, it survives factory resets and is difficult for average users to remove.

Experts say the most likely vector is the supply‑chain process that outfits inexpensive devices with generic firmware supplied by third‑party manufacturers. In many cases, original equipment manufacturers source hardware and software from overseas factories where quality control and security vetting are less rigorous. The malicious firmware is then flashed onto the device before it is boxed and shipped.

For end users, the consequences range from privacy erosion to financial loss. Data such as contacts, location history, and banking credentials can be siphoned without the user’s knowledge, while intrusive ads degrade performance and battery life. The embedded nature of the malware means that standard removal tools, including factory resets, are ineffective, leaving owners with limited recourse.

The issue is particularly concerning given the dominance of low‑priced Android handsets in emerging markets, where they serve as the primary gateway to the internet for millions. A compromised device can become a conduit for broader attacks, amplifying the risk to both individuals and the regional digital ecosystem.

Following the discovery, the research team notified device manufacturers, mobile carriers, and Google’s Play Protect program. Preliminary responses include the release of over‑the‑air firmware patches for affected models and advisories urging users to purchase phones from reputable retailers. Security analysts also recommend flashing a clean custom ROM where possible, though this approach requires technical expertise.

The Midnight Mimosa episode underscores the urgent need for stronger supply‑chain security standards in the mobile industry. Industry groups are calling for mandatory firmware signing, transparent component sourcing, and more rigorous pre‑deployment testing. Regulators in several jurisdictions are reviewing whether existing consumer‑protection laws adequately address firmware‑level threats.

As the investigation continues, users of budget Android devices are advised to stay alert for unusual behavior, keep their operating system updated, and consider devices that receive regular security updates from the manufacturer. The episode serves as a reminder that cost savings should not come at the expense of fundamental digital safety.