Bitdefender researchers found malware called Midnight Mimosa preinstalled in the firmware of low-cost Android phones sold across more than 150 countries.

The malware runs with system-level privileges and cannot be removed like a normal application. Bitdefender says it can silently install or delete apps, grant permissions and load arbitrary code from a remote operator. Observed activity included ad fraud, click fraud, device profiling and use of infected phones as residential proxy nodes.

Because the compromise occurs before the buyer turns on the device, conventional advice about avoiding suspicious downloads is not enough. The trust failure sits in the manufacturing and firmware supply chain, below the application layer.

Enterprises that permit low-cost or unmanaged Android devices should treat authentication as only one signal. Device attestation, secure boot, firmware inventory and backend enforcement of integrity checks can reduce risk. Manufacturers also need reproducible builds, cryptographic signing and independent testing of the firmware that actually ships.