Bargain Android phones ship with preinstalled malware, and users can’t delete it

Preinstalled malware has been found on thousands of off-brand Android phones across more than 150 countries. The corrupted devices power a massive ad fraud operation: the malware installs cover apps, misuses legitimate ad toolkits (SDKs) to generate fake impressions, clicks, and revenue.

Bitdefender unveiled the huge ad-fraud campaign, which involves dozens of Android phone brands that ship with embedded malware that can’t simply be uninstalled.

The malware, dubbed Midnight Mimosa, runs with system-level privileges. The operators use it to install and remove other apps, grant them permissions, and load arbitrary code to carry out ad and click fraud, and to include infected devices in botnets for residential proxy services or DDoS attacks.

“The campaign was observed on thousands of unique devices across more than 150 countries. The geographic distribution is led by Mexico, France, and Italy, followed by the United States, Germany, Brazil, and Spain,” Bitdefender said in a report.

Many phone models are affected. Over 11% of compromised devices present themselves as “KINGKONG X,” which is associated with Cubot, and over 4% present themselves as “S200 X,” which is associated with Doogee.

However, the top 15 phone brands accounted for only 35.8% of unique infected devices, with the remaining 64% assigned to “others.”

The affected devices are often low-cost and use MediaTek platforms.

“Many of the affected models are counterfeit devices that borrow flagship names they have nothing to do with. Fake iPhones include: "i17 Pro Max", "i16_Pro_Max", or "17_Pro_Max", and an "iPadAirPro" for the tablet line. Samsung's Galaxy is copied just as freely, with free-text "S25 Ultra," "S24 Ultra," or "Note 18 Ultra" strings, Bitdefender explains.

The malicious app is platform-signed by Shenzhen Zediel Co., Ltd., a real Shenzhen-based Android OEM/tablet maker.

It masquerades as a system component, using names like com.android.system.lite, com.android.sys.prot and others.

Additionally, 13 published apps were found on Google Play that contained the same malicious code.

“The campaign is not confined to preinstalled firmware,” Bitdefender warns.

“These applications passed Play review and were distributed by Google to users who went looking for a weather app or a QR scanner. No counterfeit hardware is involved.”

Caught in an act: How does it work?

The malware behavior appears strange at first sight. It drops other cover apps on the device that don’t do anything malicious on their own, like a weather app, an app-lock app, a note app, an OCR app, and other ordinary-looking apps.

They all carry a legitimate advertising SDK – a toolkit provided by an advertising platform that enables them to display ads and receive revenue.

“They are what the ad network sees,” the researchers at Bitdefender explain.

“The network credits an impression and a click to the application hosting its SDK and its ad unit identifiers.”

The Midnight Mimosa malware executes remotely supplied code to covertly fabricate impressions and clicks to earn money. Users don’t see anything while the ads are being displayed and clicked in the background.

The malware plugin supplies the logic, the timing, and the synthetic interaction – the ad unit, and therefore the payment, belongs to the cover app.

The researchers identified at least 32 unique disguised payload apps. The malware grants itself a plethora of dangerous permissions and disables Google Play Store protections during the installation or uninstallation of fake apps. It reenables the Google Play Store after the payload completes.

Ad fraud via fake apps is not the only functionality. The malware maintains a foothold and can run multiple other payloads, such as enrolling devices into a residential proxy botnet, and potentially help launch DDoS attacks.

It remains unclear at which point in the supply chain the malware is integrated.

It could be introduced by an original device manufacturer, a firmware integrator, a logistics partner, or another actor further down the distribution chain,

Bitdefender said.

The researchers warn that some sellers lure buyers with cheap hardware, only to load it with software that generates revenue afterward, while users can’t do anything about it.

“Because the root component ships in the system partition, an affected owner cannot remove it by the normal route. Clearing the device requires firmware-level cleanup or disabling the component over ADB, and neither is realistic for most people who own these phones,” the report reads.

Users should avoid using such a device for banking, authentication to sensitive accounts, or storing important data. Scanning the phone with mobile security software might help detect the compromised device – contact the seller or manufacturer for a replacement.