Cheap Android phones found with malware already installed

Buying a can feel like a smart move. After all, why spend hundreds more when a phone promises a big screen, decent cameras and all the Android apps you use every day? But what if that bargain phone came with a hidden surprise that was already hiding inside the device when you bought it?

Security researchers at Bitdefender have uncovered a called Midnight Mimosa that infects certain low-cost Android devices before their owners even turn them on.

The malicious software hides inside the phone's firmware, giving attackers powerful access that ordinary apps never receive. Even more concerning, researchers found related malicious apps on Google Play. And this problem has reached the United States.

Join our upcoming CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money

In this free live online class, Kurt "CyberGuy" Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season. Youll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.

Join us Saturday, October 31, at 11 AM ET / 8 AM PT. Register free now at CyberGuyLive.com.

ANDROID MALWARE CAN STEAL YOUR PIN AND BANK LOGINS

Most smartphone security advice starts with being careful about what you download. That makes sense when a malicious app tricks you into installing it. Midnight Mimosa changes that equation because the infection can arrive with the phone itself. According to Bitdefender's investigation, the malware was discovered on low-cost, multi-brand built around MediaTek chipsets. Researchers found malicious applications embedded in the system software, where they could operate with elevated privileges.

These privileges allow the malware to install additional apps without permission, remove existing applications and grant sensitive access to other software. It can also download and execute new code from remote servers. The researchers identified several versions hiding behind innocent-looking Android package names, including com.android.system.lite, com.android.sys.prot and com.android.sys.gmsprot.

To most phone owners, those names would look like technical components that belong there. That's exactly what makes the scheme so difficult to spot. And because the malicious software lives in the system partition, a normal uninstall won't remove the underlying infection.

Bitdefender says it observed Midnight Mimosa on thousands of unique devices across more than 150 countries over approximately two years. Mexico, France and Italy had the highest observed numbers, followed by the United States, Germany, Brazil and Spain. Researchers also observed infected devices reporting model names associated with Doogee's S200 X and Cubot's KINGKONG X. However, the findings do not establish that every phone sold under those names is affected. Some devices in the campaign use misleading or counterfeit model identifiers, making it difficult to identify infections based on a phone's reported name alone.

Another part of the investigation uncovered devices pretending to be expensive smartphones. Some reported names resembling Samsung Galaxy flagship models, while others imitated naming. In other words, a phone advertised as a premium Samsung or Apple device might actually contain inexpensive Android hardware running modified software.

Researchers found that some counterfeit devices even reported legitimate-looking Samsung model identifiers. That makes checking the model name alone an unreliable way to confirm authenticity. The investigation also identified firmware signed with certificates associated with Shenzhen Zediel, a Chinese device manufactu