Low-cost Android phones are arriving with malware that owners can’t uninstall

People who buy low-cost Android phones from online marketplaces may be carrying malware that was placed on the device before it reached them, Bitdefender has found.

The campaign, dubbed Midnight Mimosa, runs on budget Android devices from different brands built on MediaTek platforms. The malware ships in the device firmware, is present before the owner switches the phone on for the first time, and can’t be uninstalled.

“The compromise is complete before the phone is first switched on,” Bitdefender noted.

“The malware runs with system-level privileges that allow it to silently install and remove apps, grant permissions, and load arbitrary code supplied remotely. This essentially means its operators could install and delete apps at will, tuning each device to their needs, including making them part of large botnets.”

According to Bitdefender, the scheme is likely designed to generate revenue.

“The operators carry out ad and click fraud, collect device and installed-app information, and turn infected devices into residential-proxy relay nodes, making them zombies in botnets. This creates an additional revenue stream, as access to botnets for DDoS attacks is a hot commodity. The larger the botnet, the more money they can charge,” they added.

The campaign was observed on thousands of unique devices in more than 150 countries. Mexico, France and Italy lead the list, followed by the United States, Germany, Brazil and Spain.

A number of the affected models are counterfeits that borrow flagship names. Model strings include “i17 Pro Max”, “S25 Ultra”, “S24 Ultra” and “Note 18 Ultra”, and some devices that aren’t made by Samsung report the Galaxy S25 Ultra model code SM-S938B.

Counterfeit flagship phone sold through a mainstream online marketplace (Source Bitdefender)

The two most common models among infected devices are the Doogee S200 X and the Cubot KINGKONG X. On the XDA forum, owners of Cubot and Doogee phones reported suspicious apps that kept reinstalling themselves after they removed them.

How it was found

The investigation began when com.android.system.lite was flagged by Bitdefender’s App Anomaly Detection for behaving unlike a system component. It repeatedly switched on Accessibility and Notification Access, and silently installed and removed unrelated apps.

One of those apps, com.mobile.applock.wt, posed as an app lock but had no app lock code and stayed hidden from the user. It turned out to be a heavily obfuscated dropper, though it was not the root cause of the infection.

The system app was platform-signed, and its malicious code was hidden in a native library that only came to life at runtime. Because the app came preinstalled, watching its behavior was the only way left to catch it, according to the researchers.

Disguised as “System”

The app goes by the label “System”, has no icon and doesn’t appear in the launcher. It runs as the system user and pulls further code from a command and control (C2) server.

Bitdefender calls this component the enabler, because its job is to install and control the apps that carry out the fraud. The same code also ships under other names, including com.android.sys.prot, com.android.sys.gmsprot and com.android.sys.bcprot.

Access to screens and messages

The malware sends the phone’s IMEI, Android ID, MAC address and timezone to its C2 server, and gives itself Accessibility, Notification Access and SMS permissions.

Bitdefender did not see these permissions used during its analysis, but they are available to the operators on demand.

Accessibility access lets an app read everything on screen, see what the user types and tap through apps on the owner’s behalf. Notification Access exposes chat messages, and SMS access allows reading one-time codes and sending texts to premium numbers.

The researchers also note that the code the malware loads comes from a server whose operators have a history of premium SMS subscription fraud.

Ad fraud and detection evasion

The system app installs and removes a rotating set of at least 32 disguised apps, among them weather, app lock, note-taking, OCR, file manager and audio editing tools. These cover apps carry a legitimate ad SDK, and they are what the ad network sees and pays.

A hidden plugin then shows ads the owner didn’t ask for, in windows that cover the screen or appear over other apps, for example when the display turns on. The ad windows are marked as secure, a flag meant to keep banking screens out of screenshots, so the owner can’t capture them in a screenshot or screen recording.

Settings pushed from the C2 server decide how often a click gets registered with no user touch, and where on the ad the fake tap lands, to make the traffic look human.

The same ad-fraud code also turned up in 13 apps on Google Play, which talk to the same servers as the preinstalled malware. These apps passed Play review and reached people who went looking for a weather app or a QR scanner.

They lack the system-level rights of the preinstalled version, but they still show ads outside the app, sometimes when the phone isn’t in use.

The apps were signed with 13 different certificates and published under at least two developer accounts, fivedev and CPS Developer.

“The link between them is the shared code, not the certificate. An actor who rotates signing identity per package is anticipating that any one of them will eventually be burned,” Bitdefender explained.

Right before installing one of these apps, the malware disables the Google Play Store app, which hosts Play Protect’s on-device scanner. When the install is done, it switches the store back on. A separate safeguard re-enables the Play Store when the user is present, to avoid raising suspicion.

Some samples also register Google Play as the place they were installed from, even though they never came from the store. The giveaway is a missing signature block, which Google adds to apps distributed through Play.

No easy fix for owners

The system app on some devices was signed with a certificate bearing the name of Shenzhen Zediel, a Chinese Android device maker. Bitdefender stresses this does not prove the company wrote or distributed the malware, or knew about it. Phones without Zediel-signed firmware carry the same malware.

“The malware ships with the device. What remains unclear is at which point in the supply chain it is integrated. It could be introduced by an ODM, a firmware integrator, a logistics partner, or another actor further down the distribution chain,” researchers stated.

Because the malware lives in the system partition, owners can’t remove it the usual way. Getting rid of it takes firmware-level cleanup or disabling the component through Android Debug Bridge (ADB), a developer tool that controls the phone from a computer, and Bitdefender says neither is realistic for most people who own these phones.

“The durable fix sits with the vendors and the marketplaces that ship and sell the affected firmware,” Bitdefender concluded.