Midnight Mimosa: How to Check for Malware on a New Android Phone
Midnight Mimosa can come preinstalled on Android phones. Learn how to check a device, spot warning signs and respond if you suspect an infection.
👁 115 reads
Midnight Mimosa is malware that can get onto Android phones before they are sold - before a device reaches its first owner. It has been detected on thousands of devices in more than 150 countries. The question is no longer just what not to install, but what not to buy.
What this means for you
If you buy a phone through an established brand’s official sales channels, the risk is low. If you buy a very cheap device from an online marketplace, an overseas seller or a brand you have never heard of, the risk rises. The key difference from an ordinary virus is that preinstalled malware can reside in the system partition, so a factory reset will not remove it. The source material does not give a complete list of affected models or identify who is behind the campaign - you will need to consult the original report for those details. Our view: for most people, the cheapest protection is not antivirus software but making a more careful buying decision ten minutes earlier.
How this can happen
A smartphone is not assembled by a single company. The manufacturer may source the processor from one supplier, the casing from another and the software - often a ready-made Android image with added software - from a third, usually a company that prepares systems for specific models. This stage can be among the cheapest and least closely monitored parts of the supply chain. If someone adds a component to the system image, it can end up on every device that rolls off the production line.
That is why this kind of threat spreads differently from a conventional infection. The user does not have to click anything or download an app from outside an app store. The phone may already be infected when you take off the protective film.
Where the risk may be higher
The source material does not identify specific sales channels or regions, so the following is an assessment based on how the supply chain works, not a finding from the report. But the underlying logic is fairly predictable.
Phones bought at the lowest end of the market are potentially more exposed, particularly when sold through less-established online marketplaces, imported privately or made by brands with little local presence. Phones bought for children or older family members may also warrant extra care if price is the main consideration.
Used and refurbished phones from unclear sources are another concern. If a seller has installed firmware downloaded from an online forum, the device contains whatever that firmware included.
Warning signs to watch for
| Warning sign | What it could mean | How to check |
|---|---|---|
| Background data use on a newly unboxed phone | Something is communicating with a server without your involvement | Settings - Network - Data usage; sort apps by data use |
| A system app that you cannot uninstall or disable | A component may be embedded in the system partition | Settings - Apps - show system apps |
| The battery drains unusually quickly when the phone is idle | A process may be running continuously in the background | Settings - Battery - usage by app |
| Ads appear outside the browser, including on the home screen | This is typical of a monetisation module | Check whether they appear when apps are closed |
| A factory reset makes no difference | This is the strongest indication of a system-level infection | Repeat your checks after the reset |
No single warning sign proves that a phone is infected. A cheap phone may have a weak battery or an intrusive manufacturer interface without any malware. A combination of several signs - especially the last one - is more concerning.
What antivirus software cannot do
Antivirus apps from Google Play run in the user space. They may detect a suspicious component and alert you, but on a non-rooted phone they do not have permission to remove software from the system partition. This is not a flaw in any particular product; it is a consequence of Android’s architecture.
If a factory-installed infection is confirmed, you have three options: return the phone to the seller, flash clean firmware from the manufacturer (if it exists and is publicly available), or stop using the phone for anything sensitive. That last option may sound drastic, but for a low-cost phone it can be the simplest solution.
What to do if you own one
- Consult the original report’s list of models and check your device. Find the exact model number in Settings - About phone, not on the box, because marketing names can differ.
- If your model is not on the list, do a one-time check anyway: go to Settings - Apps - show system apps and look for entries you do not recognise. Do not remove anything blindly; search for the name first.
- Check data usage over the past month. An app you have never opened that has sent tens of megabytes is worth investigating.
- Before your next purchase, check three things: whether the brand offers official support where you live, whether the manufacturer publishes security updates and whether you can contact the seller if something goes wrong.
- If your new phone is on the list, do not wipe it. Contact the seller to arrange a return or other remedy. Keep your proof of purchase and screenshots of any warning signs.
- If you are concerned about a phone, do not install banking apps or sign in to sensitive accounts on it. Use another device instead, even an older one.
- If you are buying a phone for someone who is unlikely to check it themselves - such as a parent or child - consider choosing a device from an established brand’s official sales channel.
Source
Antyweb: This is no joke - you could buy a new phone with a virus. Check whether your device is on the list, accessed 19 October 2026. The full list of models and technical details about the Midnight Mimosa campaign are in the source material and the report cited there.
