Budget Android Phones May Carry Preinstalled Malware

Some low-cost Android phones may contain malware before the owner installs a single app. A recent investigation found a threat known as Midnight Mimosa on certain MediaTek-based devices sold under multiple brands. The malware is built into the phone’s firmware, meaning ordinary app removal or a factory reset may not fully remove it.

The hidden component can receive commands from remote operators, install additional apps and request sensitive permissions such as accessibility, notifications and SMS access. It may also help install seemingly harmless utility apps that display ads fraudulently. In some cases, affected phones can be used as residential proxies, allowing third parties to route internet traffic through the owner’s connection.

This matters for Indian users because budget Android phones are widely used for UPI, banking, work and personal communication. There is no confirmation that any specific phone sold in India is affected, and the threat has not been linked to banking-data theft. Still, users should be careful with devices that are unusually cheap, unbranded or sourced through unknown online and grey-market sellers.

Buy phones from authorised sellers, check installed apps before signing in to important accounts and keep Android updates enabled. Watch for unexplained battery drain, high data use, pop-up ads or apps appearing without permission. If a new phone seems doubtful, avoid using it for banking or UPI and contact the seller or manufacturer. Businesses should also set clear device-security standards for staff accessing work email and data.

Firmware-level malware needs action from the device maker or seller and should not be treated as something any security app can reliably remove. For everyday protection against fraud-related risks on computers used alongside mobile devices, NPAV Total Security Fraud Protector is listed as helping protect identities, passwords, emails and payments. It is a complementary security layer, not a remedy for suspected phone-firmware malware.