Cybersecurity experts warn of malware pre-installed on cheap Android phones

Cybersecurity experts are warning of a growing threat where certain Android devices arrive with malicious software pre-installed in the system firmware. This allows malware to persist even after a user performs a factory reset.

Bitdefender researchers identified a campaign dubbed ‘Midnight Mimosa,’ which targets inexpensive Android phones, including specific models from brands such as Doogee and Cubot, as well as counterfeit devices mimicking well-known manufacturers. The embedded malware can automatically download additional applications to generate fraudulent ad clicks, allowing criminals to profit from advertising networks. There are also concerns that these devices could be used as intermediaries for malicious internet traffic.

Additionally, Kaspersky previously reported on versions of the Triada Trojan found in fake Android phones, which can compromise messages, social media accounts, and cryptocurrency wallets.