I bought a 60 euro Android phone online. Can it already be infected?

The question sounds paranoid and in fact it has a documented answer. Yes, it can already be infected. The interesting part is where it sits: in some documented cases the unwanted code sits in a part of the phone you cannot reach, signed with the same key the manufacturer uses to sign Android. As far as the phone is concerned, it is one of its own official components.

On 8 October 2026 Bitdefender’s labs published their analysis of a campaign they christened Midnight Mimosa. The title of their report says it all: the phone was compromised before the user turned it on.

Let us start there, then get to what you can do, which is less than you would like but more than nothing.

What Bitdefender found

The main component is called com.android.system.lite and it sits in the system partition. It is signed with the device’s platform key, and that is the technical detail which explains all the rest: there is no “Uninstall” option, because as far as Android is concerned this is not an installed app, it is part of the phone.

What it does, according to the report: it silently installs and removes a rotating set of at least thirty-two disguised apps, grants itself accessibility, notification access and SMS permissions, downloads a configuration from the internet and runs code through plugins, collects information about the device and the apps on it, and enrols the phone as a node in a residential proxy service. Plus a strand of advertising fraud, running through cover apps and through a legitimate ad network that gets credited with views and clicks nobody ever made.

One clarification the researchers themselves put in, and it should be carried over: the malware does obtain those permissions, but Bitdefender states it did not observe them actually being used. Having the ability to read text messages and reading them are two different things, and the report stops at the first.

The piece I find most instructive is a different one, because it answers the question that comes naturally. The component disables the Play Store before installing some payloads and re-enables it afterwards, and presents itself as a faked “Google Play” installer. So the defence that is supposed to protect you gets switched off by the piece of software sitting below it. At that point no antivirus can help, because the hierarchy is wrong from the start.

On the numbers, precision is needed. Bitdefender writes that it observed the campaign on thousands of distinct devices in more than 150 countries, across a span of around two years. It is a count of what their own product saw rather than an estimate of how many infected phones there are in the world, so it reads as a lower bound, and it depends on where that product is installed. In the geographical breakdown Italy comes third, after Mexico and France. No percentages and no per-country figures: those numbers are not published, and anyone giving them to you has made them up.

The devices named are of two kinds. On one side, clones with counterfeit names imitating famous phones, things called “i17 Pro Max” or “S25 Ultra” or “Note 18 Ultra”, on MediaTek platforms, with ODM codes and the EEA suffix, which stands for European Economic Area: destined for the European market, so for ours too. On the other side, and this is the more awkward part, two real brands: Bitdefender names a Doogee S200 X and a Cubot KINGKONG X.

The signing certificate leads to the name of a company in Shenzhen. Bitdefender says expressly that this does not prove that company wrote the malware or knew about it, so I am not reporting it as an accusation: one link in the supply chain is enough to explain it.

One last caution, and I put it in because it is a rule I always apply: Midnight Mimosa is a name coined by a single security vendor, six days before I wrote this article. As of 14 October 2026 nobody else has adopted it, no CERT, no authority. The technical facts in the report are detailed and checkable, but the name has a single source.

This is not new, and that is the point

A bit of history helps make clear that this is not an isolated incident.

In 2019 Google’s Android security team published its reconstruction of Triada, and the sentence to hold on to is this one: Triada infects devices’ system images through a third party, during the manufacturing process. Google also explains the how, which is the useful part: OEMs sometimes send the complete system image to an outside company to have a feature developed in it, face unlock for example, and the image came back infected. You do not need a complicit manufacturer. You need a supplier.

In April 2025 Kaspersky documented a new version of Triada, still in the firmware, with a library planted in the system folders and loaded by the process that starts every app. Firmware already infected before sale, on devices sold through online marketplaces, imitations of well-known brands.

Then there is the BADBOX family, which concerns TV boxes and connected devices more than phones, but is useful for the numbers. In December 2024 the German federal office for information security diverted the traffic of up to 30,000 devices in Germany, stating explicitly that it assumed many more infections remained undetected, and stating something else worth repeating: in all the known cases the malware was already installed at the point of purchase. The BSI’s advice on those devices is to stop using them.

On the scale of the thing, two sources give figures an order of magnitude apart. HUMAN Security, in a report from March 2025, estimates more than a million infected devices as of January 2025. Google in July 2025, announcing legal action, talks about over ten million compromised uncertified devices. The FBI, in June 2025, says only “millions”, without a figure. Six months and a factor of ten, with probably different perimeters, and neither of the two publishes the method by which it got its number. I say this because it is the most useful piece of information: the phenomenon is big, but anyone quoting you a precise figure is quoting an estimate whose arithmetic is unknown.

The three levels, and why only one is a serious problem

Putting it all under the word “virus” loses the one distinction that changes anything.

The first level is malware in the firmware, signed with the platform key. It does not uninstall. Bitdefender writes that the owner cannot remove it by the normal route and that it would take a firmware-level clean-up or disabling it over ADB from a computer, and adds that neither is realistic for most owners. In the Triada case removal came through updated system images prepared by the manufacturers, that is, through an update that arrived from above. The BSI, as I said, advises retiring the device.

The second level is the app that comes preinstalled but is not signed with the platform key. Usually it will not uninstall but it can be disabled, and sometimes removed over ADB. This is the grey zone of software the manufacturer puts in and you never asked for.

The third level is the app you downloaded yourself. It uninstalls, Play Protect checks it, and when Google updated Play Protect to block the apps connected to BadBox it was acting right here.

And a factory reset? It does not solve the first level, and the reason is almost a joke: the reset puts the phone back to its factory state, and if the factory is the problem it puts it back exactly where it was. The reset wipes your data, not the system partition. All the primary sources are consistent with this, though I should say I have not found a page of the Android documentation that writes it in those words.

What you can check right now

Two warnings before the list. First: these checks tell you whether the phone is in order and up to date, not whether there is malware in the firmware. A first-level piece of malware, by definition, appears on no settings screen. Second: the menu names below come from Google’s support pages, which even when called up in Italian gave me back the English strings, and manufacturers rename these items. So the routes are the ones given, the exact names you read on your own screen.

1. Look at whether the device is Play Protect certified. Open the Play Store, tap the profile icon, then Settings, then About: the certification entry is there. According to Google, "uncertified" means the results of the compatibility tests have not been recorded, that the Google apps on it are not considered genuine, and that the device may carry more security risks, get fewer updates and have no secure backup of its data.
2. Check the date of the security patches. Settings, About phone, Android version: the Android security update date is in there. Compare it with the current month. If it is many months or years old, that phone is not getting updates, whatever the listing said. The monthly bulletins are public and Google warns manufacturers at least a month before publishing them, so the delay is not a technical excuse.
3. Watch the traffic and the battery drain when you are not using the phone. A device enrolled as a residential proxy makes outbound connections even while idle, because it is routing other people's traffic. The FBI lists among its indicators unofficial app stores, requests to disable Play Protect, unbranded devices advertised as "unlocked" and unexplained internet traffic. And it points out, quite rightly, that these indicators on their own confirm nothing.
4. If the phone is already in the house and the signs are there, the route the BSI sets out for affected devices is drastic: disconnect it from the network and stop using it. I understand that for a phone you have just bought this is a harsh answer. I do not have a better one that is honest.

On certification there is a trap worth telling. Google publishes a list of certified partner brands, and Doogee, Cubot and Blackview appear on that list, which is to say two of the brands Bitdefender names among the affected devices. This is not necessarily a contradiction, because the list is by brand and not by model. But the conclusion is clear: “the brand is on the list” does not mean “this model is certified”, and it does not mean “this firmware is clean”. The check has to be done on the device.

What Europe already requires today

This is the part that makes the opening question less hopeless, because a phone sold legally in Europe has to meet certain rules, and you can check some of them before buying.

The most useful one is also the least known. European regulation 2023/1670, applicable from 20 June 2025, requires for smartphones sold in the Union that security, corrective and functionality updates be made available free of charge for at least five years from the end of the placing on the market of that model. Security updates have to arrive within four months of the publication of the source code of the underlying operating system update, functionality updates within six months. Five years, free, by law. A 60 euro phone that declares nothing on this point is very probably outside that regime.

Then there are the cybersecurity requirements for radio equipment, brought in by delegated regulation 2022/30: they cover harm to the network and misuse of network resources for all equipment that communicates over the internet, protection of personal data for equipment that processes it, and protection against fraud for equipment that allows money transfers. A smartphone falls into the first two categories without argument, and into the third if you make payments with it. A phone with malware in the firmware does not meet those requirements: it is the most direct legal argument there is on this subject. The original date of application was 1 August 2024, then postponed by a year by a regulation of July 2023, and I should flag that I only found the new date in secondary sources, not in the consolidated text: so I take it as probable and not as verified.

On online sales, the rule that closes the “but I bought it from a Chinese website” loophole is the general product safety regulation, applicable from 13 December 2024. Article 4 establishes that an online offer directed at consumers in the Union counts as making available on the market. Article 16 says a product cannot be placed on the market unless there is an economic operator established in the Union who is responsible for it. Article 19 requires a distance offer to indicate clearly and visibly at least the identity of the manufacturer, the identification of the product and the safety warnings. Those are three things you can look for on the product page before buying, and their absence is already an answer.

How much this counts in practice is set out in a Commission report of March 2025. In 2023, 2.3 billion items worth no more than 150 euro were imported into the Union, and for 2024 around 4 billion consignments from distance sales were expected, against around 300 million traditional imports a year. In a joint action on online offers originating in third countries, only 31 out of 215 were found to comply with the obligation to have a responsible person in the Union. The sample is small and the figure has to be quoted with its denominator, but that is the order of magnitude.

The Cyber Resilience Act, the one people talk about as the great European rule on the security of digital products, today bites only in part: from 11 September 2026 manufacturers have to report exploited vulnerabilities and serious incidents, with an early warning within 24 hours and a full notification within 72, through a platform run by ENISA. The main provisions arrive on 11 December 2027, and from then the end date of the support period has to be stated at the point of purchase.

A piece of reality, so as not to end with a list of laws. In May 2026 the Commission fined Temu 200 million euro for breach of the digital services regulation, in relation to the illegal products present on the platform: a mystery shopping exercise had found that a very high proportion of the chargers tested failed basic safety tests. It concerns unsafe products in general, not preinstalled malware, so it is not a precedent on our subject. It serves to say that the enforcement machinery exists and that sometimes it bites.

On imported phones with compromised firmware I have not found any public statement from the Italian competition authority, from the Ministry, from the national cybersecurity agency or from CSIRT Italia. Not even on the phenomenon in general. That does not mean one does not exist: it means I did not find it.

To understand what sits underneath

If you want to see how the parts discussed here are made, from the processor to the memory, I explained it in How a computer really works, from the ALU to the NPU. And on updates, which are the real line between a device that is alive and one that is already finished, there is Windows 10 stopped getting updates: what you risk and your three options, which is about computers but the reasoning is identical.