Key facts
- Bitdefender Labs disclosed a campaign named Midnight Mimosa in which malware ships preinstalled in the firmware of low-cost, multi-brand Android phones built on MediaTek platforms.
- The malware runs as a platform-signed system component with privileges to silently install and remove apps, grant permissions and run remotely supplied code, and it cannot be removed through normal uninstall.
- Bitdefender observed thousands of affected devices in more than 150 countries over roughly two years, with the largest counts in Mexico, France, Italy, the US, Germany, Brazil and Spain.
- Cleanup needs firmware-level work or disabling the component via ADB, which is impractical for most owners. A factory reset may not suffice, and replacing the phone is the common advice.
Bitdefender Labs disclosed a campaign it calls Midnight Mimosa on Oct. 8, 2026, in which malware ships preinstalled in the firmware of low-cost, multi-brand Android phones built on MediaTek platforms. The researchers say the phones were compromised before the user turned them on. Bitdefender could not say where in the supply chain the code was inserted.
This analysis traces what the component collects and where it reports, sets out what is still unknown about who handled the firmware, and covers what outlets say owners can do.
What Bitdefender found
According to Bitdefender, the malware runs as a platform-signed system component, meaning Android treats it as part of the operating system. Bitdefender says it has privileges to silently install and remove apps, grant permissions and run remotely supplied code, and that it cannot be removed through a normal uninstallation.
The researchers observed thousands of affected devices in more than 150 countries over roughly two years. The largest counts were in Mexico, France, Italy, the US, Germany, Brazil and Spain, according to BleepingComputer’s account of the report.
every user-facing defense had already been bypassed
Bitdefender researchers, Hackread – Cybersecurity News, Data Breaches, AI and More
Where the data goes
Bitdefender says operators use infected phones for ad and click fraud and collect device and installed-app information. They also enroll devices as residential-proxy relay nodes in botnets. A residential proxy routes third-party traffic through an ordinary consumer IP address, which hides where that traffic really comes from.
A proxy component in a fake app locker registers devices with a command server over TCP port 6000, according to BleepingComputer’s summary of the findings. The proxy command server was live, but Bitdefender’s test device received no relay targets, so active traffic forwarding was not confirmed.
The preinstalled component holds Accessibility, Notification Access and SMS capabilities, and it enables the first two itself, Bitdefender says. The researchers did not observe them used maliciously, but say the operator could activate them remotely.
How the malware avoids checks
Bitdefender reports that before silently installing payloads, the malware temporarily disables the Google Play Store package and re-enables it afterward. The company assessed that this may avoid Play Protect checks. Some variants also make sideloaded apps look as if they were installed from Google Play.
Bitdefender identified about 32 disguised payload apps, including weather, app lock, notes and OCR tools. The apps that earn ad revenue load real ads through a legitimate ad SDK in hidden windows, according to the reports.
Bitdefender also found 13 apps on Google Play that contained the same ad-fraud code and talked to the same infrastructure. Those apps lack the privileges of the preinstalled components, the researchers say.
The supply-chain question
Bitdefender named candidates for where the code entered: an original design manufacturer (ODM), a firmware integrator, a logistics partner or another downstream actor. It did not say which. An ODM builds phones that other brands then sell under their own names.
Some affected firmware was signed with certificates attributed to Shenzhen Zediel Co., Ltd. Bitdefender says this does not establish that the company inserted the malware or knew of it, and that other company names also appeared in the investigation.
Affected devices included models reporting as Doogee S200 X and Cubot KINGKONG X, plus counterfeit phones with spoofed flagship names such as S25 Ultra. Bitdefender notes that model strings are self-reported and can be faked, and it does not claim Doogee or Cubot knowingly shipped the malware.
BleepingComputer reported that some Doogee and Cubot owners on an XDA forum described apps reinstalling after removal. Some said manufacturer firmware updates fixed the problem, while one Doogee Fire 3 Max owner said an official update caused the infection. The manufacturers have not publicly explained how the code got into the firmware, BleepingComputer reported.
Those accounts are anecdotal and point in different directions. Together with the unresolved certificate question and the list of possible insertion points, they leave open which company in the chain handled the firmware when the code appeared.
Why this keeps happening
Bitdefender frames cheap and counterfeit phones as a business model in which vendors sell hardware at a loss and recoup the cost by monetizing the preloaded software. Bitdefender says shipping malware this way has been documented before, and that this campaign resembles Dr.Web’s Android.Phantom family, now with proxyware (software that rents out device connections as proxies) added.
Earlier reporting has described the BadBox case, which is based on Triada. That reporting says the FBI warned in 2025 that BadBox infected millions of low-cost devices, and that Google confirmed a 2019 supply-chain attack affecting thousands of devices.
What outlets say owners can do
BleepingComputer and Android Police report that cleanup needs firmware-level work or disabling the component through Android Debug Bridge, a developer tool for controlling a phone from a computer. They describe that as impractical for most owners.
The reports also say a factory reset may not suffice and that replacing the phone is the common advice.
On counterfeits, Android Police and PhoneWorld report that Samsung and Apple names appear on counterfeit units only, and that genuine Samsung phones are unaffected. Bitdefender found counterfeit phones with spoofed flagship names such as S25 Ultra among the affected devices.
Android Pure reported that as of Oct. 8 no vendor fix had been announced.
What to watch next
- Whether Doogee, Cubot or other device makers publicly explain how the code reached their firmware, which BleepingComputer says they have not done.
- Whether any vendor announces a fix, which AndroidPure said had not happened as of Oct. 8.
- Whether Bitdefender or others narrow down the insertion point among the candidates it named.
- Whether active traffic forwarding is confirmed, which Bitdefender's test device did not show.
Join the discussion