# Android Phones with Preinstalled Malware Threaten Global Security

*Published October 21, 2026*
*Source: [https://cybersecuritynews.com/thousands-of-android-phones/](https://cybersecuritynews.com/thousands-of-android-phones/)*

## Executive Summary

Researchers have found preinstalled malware on thousands of low-cost Android phones worldwide, allowing attackers significant system access. This malware can disable Google Play protections, install malicious apps, and conduct ad fraud, highlighting the need for robust scrutiny of device firmware.

## Article

A widespread security threat has been uncovered involving thousands of Android phones across over 150 countries. The malware campaign, dubbed Midnight Mimosa, has been discovered in the firmware of low-cost Android devices, granting attackers deep system access without user intervention. This preinstalled malware can install and remove applications, execute new code, and generate fraudulent advertising activity by disabling and then restoring the Google Play Store package to avoid Play Protect detection.

The discovery was detailed in a research report by PolySwarm, which builds on Bitdefender's findings of thousands of infected devices over a two-year period. Countries most affected include Mexico, France, and Italy, followed by the United States, Germany, Brazil, and Spain. The infection initiates via a malicious system application signed with an Android platform certificate, allowing it to perform various actions like installing packages and altering settings.

The malware conceals its primary functions in a native library, which uses RC4 encryption to unpack a hidden Java framework. This framework communicates with command-and-control servers to download plugins that adjust the malware's behavior. These plugins facilitate advertising fraud and silent app installations, often masquerading as ordinary tools such as weather apps and file managers.

In addition to advertising fraud, the malware has a proxy component that can establish two-way TCP tunnels, potentially allowing external traffic through an infected device's internet connection. While the capability was confirmed, no traffic relaying was observed during testing. The devices affected include budget MediaTek-based phones, counterfeit flagship models, and devices with identifiers linked to brands such as Doogee and Cubot.

Google's app safety measures focus on applications during installation and periodic device scans. However, this situation underscores the importance of scrutinizing trusted system components. Cleanup efforts must target the underlying firmware, not just individual apps, to effectively address such embedded threats.