Low-Cost Android Phones Infected with Midnight Mimosa Malware
A newly uncovered malware campaign called 'Midnight Mimosa' has been found preinstalled on low-cost Android devices, turning them into residential proxies and executing ad fraud.
Radwan AbdulhadiEditor and technology writer
Midnight Mimosa Campaign Targets Budget Smartphones
A sophisticated malware campaign designated as 'Midnight Mimosa' has been uncovered on low-cost Android smartphones. According to details shared by Bitdefender researchers, the malicious software is embedded directly into the firmware of budget devices utilizing MediaTek chipsets. This deep system-level integration grants the malware elevated privileges, enabling it to install and remove applications, grant sensitive permissions, and execute remotely downloaded code without requiring any user interaction.
The campaign has reportedly impacted thousands of devices across more than 150 countries over an approximate two-year period. The highest concentrations of affected victims were identified in Mexico, France, Italy, the United States, Germany, Brazil, and Spain. Investigators found preinstalled malware on hardware models associated with legitimate manufacturers, including the Doogee S200 X and Cubot KINGKONG X, alongside counterfeit devices impersonating Apple and Samsung products.
User Reports and Supply Chain Concerns
Discussions on community platforms, such as an XDA forums post, highlighted instances where owners of Cubot and Doogee smartphones discovered persistent, suspicious applications that repeatedly reinstalled themselves even after being uninstalled by the user.
One Doogee Fire 3 Max owner noted that applying an official firmware update introduced the malware onto the device. The malicious packages reportedly vanished after rolling back to an older firmware version, only to return once the update was reapplied. While some users confirmed that manufacturers eventually released updates to fix the infections, the hardware makers have not publicly explained how the malicious software infiltrated the firmware during the supply chain phase.
System-Level Stealth and Ad Fraud Mechanism
Unlike traditional Android malware that relies on users downloading malicious files, Midnight Mimosa is preinstalled in the system partition before the device reaches consumers. The malicious binaries mimic legitimate Android system packages with names like com.android.system.lite, com.android.sys.prot, and com.android.sys.gmsprot. Because these components are signed and operate with high privileges, standard uninstallation methods fail to remove them.
The security team discovered the threat when its App Anomaly Detection tool flagged com.android.system.lite for silently managing other apps. The framework downloads extra modules from command-and-control servers, utilizing disguised cover applications—such as weather utilities, file managers, and OCR tools—to load legitimate ad SDKs. These helper apps display invisible windows over other running software to register fraudulent impressions and clicks without the user ever noticing.
To maintain stealth, the malware temporarily disables the Google Play Store app package to block Google Play Protect from scanning during silent installations, re-enabling the store immediately afterward. Some variants even manipulate recorded installer metadata to trick the system into believing that unauthorized apps originated directly from the official Google Play marketplace.
Residential Proxies and Traffic Relaying
Beyond advertising fraud, Midnight Mimosa transforms infected Android units into functional residential proxies. Disguised components like a fake app locker application contain built-in TCP proxy modules that register the device with a remote command server. Once registered, the infrastructure can route outside network traffic through the phone owner's internet connection, potentially masking the true origin of external cyber attacks or accessing locally reachable devices.
Investigators confirmed that the proxy command-and-control infrastructure was fully operational and actively accepting device registrations during testing, though no relay targets were actively assigned at the moment of observation. Additionally, researchers traced related ad fraud code inside 13 standard applications distributed via the Google Play Store under developer accounts such as fivedev and CPS Developer, while noting that firmware certificates associated with Chinese manufacturer Shenzhen Zediel were also identified during the investigation.
Remediation Challenges for Consumers
Due to the deep firmware integration of Midnight Mimosa, cleaning an infected device presents a major challenge for everyday users. Standard cleanup tools are ineffective because the core malware operates as a high-privileged system application. Mitigating the infection typically requires advanced firmware-level flashing or utilizing the Android Debug Bridge (ADB) to disable the malicious packages, a process that remains too complex for the average consumer.
Sources
- BleepingComputerLow-cost Android phones ship with residential proxy malware
Continue chronologically
Related entity coverage
Related stories
Midnight Mimosa Malware Hits Android Devices in 150+ Countries
Discover how the Midnight Mimosa firmware-level Android malware campaign targets budget smartphones worldwide with ad fraud and system-level control.
Android November 2026 Updates Patch Over 200 Vulnerabilities
Google has announced its November 2026 security updates for Android, addressing over 200 vulnerabilities, including a critical remote code execution flaw.
Amazon Drops Fire Branding for New Android Alexa Tablets
Amazon introduces its new Alexa Tablet lineup featuring Google-certified Android, the Play Store, and a redesigned unibody aluminum housing.
New Android SMS of Death Exploit Remotely Crashes Phones
A security researcher released a proof-of-concept exploit for an Android SMS of Death flaw that remotely crashes unpatched phones and cellular service.
