Some low-cost smartphones running Android arrive from the factory with malware already installed, researchers at the security firm Bitdefender have found. The malware, called Midnight Mimosa, is built into the firmware of certain Android handsets.
Firmware is the low-level software that drives the phone's hardware, so the malware is present before the phone is first switched on. It cannot be removed by uninstalling an app in the ordinary way. A buyer is therefore exposed from the moment the handset is taken out of the box.
According to Bitdefender, Midnight Mimosa operates through a permanent system app embedded in the firmware, which gives it system-level access to the phone. With that access it can install and delete apps, download additional code from a remote server, and grant permissions to other apps. Researchers identified 32 disguised apps connected to the scheme, used to generate fake advertisement views and commit click fraud — making money from activity the phone's owner never knows about.
Why "system app" is the phrase that matters
Ordinary Android malware has to persuade you to install it, and then lives with the same restrictions as any other app. You can see it in the app list, revoke its permissions and remove it.
Something shipped in the firmware sits below all of that. It occupies the same privileged layer as the phone's own built-in software, which means the security model is not protecting you from it — the security model regards it as part of the phone. That is why it cannot be uninstalled, why it can hand permissions to other apps rather than asking for them, and why a factory reset does not help: a reset restores the firmware, including this.
The ad fraud is the symptom, not the limit. A component with system access and the ability to download code from a server can be given a different job later, without the owner doing anything.
Why this lands harder in Bangladesh
This is not an exotic risk here. It sits exactly where most of the market is.
The overwhelming majority of handsets sold in Bangladesh are budget Android devices, often from brands with thin service networks, sometimes assembled or finished locally, and frequently bought from shops that cannot say who built the firmware image. The cheaper the phone, the longer the supply chain and the more hands the software passes through — and firmware is where a contract manufacturer or a middleman can insert something without the brand on the box necessarily knowing.
It also compounds a problem already on this site's record: the same phones tend to stop receiving security updates early, so even an uninfected budget handset is often running software nobody is patching.
Who is actually being robbed
Click fraud sounds victimless from the phone owner's side. The money is coming from advertisers, not from the user, and nothing visibly goes missing.
The user still pays, in three ways. The fake views consume mobile data, which in Bangladesh is bought in small packs and is a real household cost. They run the processor and drain the battery on a device chosen for being cheap. And the advertising money being stolen comes out of a pool that legitimate Bangladeshi publishers and app makers are competing for, so the local digital economy is funding it too.
That is the quiet part of pre-installed malware: it is profitable precisely because each individual loss is too small for anyone to chase.
What a buyer can actually do
Honest first: once firmware is compromised, a user cannot fix it. Everything useful here happens before purchase, or involves not relying on the device.
- Buy from an authorised distributor, not a parallel import. The brand matters less than whether anyone in Bangladesh is accountable for the software image on it.
- Treat an unusually cheap handset as a cost somewhere else. Hardware at an implausible price is subsidised, and advertising revenue from the user is one of the ways it is subsidised.
- Watch for the symptoms: apps you did not install appearing, unexplained data use, a battery that drains while idle, ads outside any app.
- Do not use a suspect phone for banking or MFS. This is the only advice that actually protects money. A phone you cannot clean should not be the phone your OTP arrives on.
Related: the account safety checklist and the Asos app notification hack.
