Some low-cost Android smartphones were distributed while already infected with malware before shipment. Caution is required because the phones can be abused for ad fraud or cybercrime even if users do not install apps separately.

TechRadar reported on Oct. 12 that security firm Bitdefender found cases in which malware called Midnight Mimosa was preinstalled in the firmware of some Android devices.

Over about 2 years, thousands of infected devices were detected in more than 150 countries. Major affected areas included Mexico, France, Italy, the United States, Germany, Brazil and Spain.

Devices confirmed to be infected included the Doogee S200 X and Cubot KingKong X. Malware was also found on imitation smartphones posing as Samsung Electronics and Apple products.

The problem is that the malware disguises itself as a system app in the operating system to secure high-level privileges. Hackers can use this to install or delete apps without users knowing and remotely run additional malware.

Bitdefender found at least 32 malicious apps disguised as a weather app, a file manager and an app lock tool. They worked by opening invisible ad windows on the screen to generate fake ad impressions and clicks and take the proceeds.

Some malicious apps also included a proxy function that turns infected smartphones into relays for external internet traffic. Attackers can abuse this for DDoS attacks, spam distribution and financial fraud.

Google Play also had 13 apps confirmed to use the same ad fraud code. The difference is that users must install those apps themselves and allow permissions.

Removing the malware is not easy. If it is installed in the system area, it cannot be resolved by deleting apps in the usual way, and firmware recovery or separate technical measures are required.

The case shows that when buying a smartphone, security reliability in the manufacturing and distribution process is important in addition to price and specifications.