“Midnight Mimosa”: Cheap Android Phones Ship With Malware You Can’t Uninstall
Bitdefender research shows the devices were compromised in the supply chain before owners ever turned them on, so no ordinary OS update or app removal gets rid of it.
A new wave of malware dubbed “Midnight Mimosa” is being embedded directly into the firmware of cheap Android smartphones before they ever reach a buyer. Bitdefender researchers found devices with the malicious software preinstalled across more than 150 countries — meaning the phone was already compromised before the owner switched it on for the first time.
What is Midnight Mimosa?
Unlike ordinary malware that arrives through a malicious app download or a phishing link, Midnight Mimosa lives at the firmware layer of the device. The attackers introduce it through the device supply chain, effectively hiding the payload inside the low-cost phone’s own system. Because it sits so deep, a factory reset, an OS update, or uninstalling apps will not remove it — the malware persists with the device itself.
Ad fraud and a residential proxy network
Once active, the malware runs hidden applications — including browsers and ad-supported apps — that silently generate fraudulent revenue. It can also flip a victim’s device into a residential proxy: a consumer phone whose IP address is quietly used to route traffic for other criminal operations. Thousands of these compromised, low-cost handsets can form a distributed network of “residential proxies,” giving attackers a pool of real consumer IPs that look much more legitimate than datacenter servers.
Researchers have linked the affected devices to low-cost phones using MediaTek-class processors and, in some cases, counterfeit or knock-off brand hardware. That combination matters because these devices are cheap, widely sold, and often not covered by the same rigorous quality controls as major brands — making them an attractive, low-friction attack surface.
What this means for you
- If you buy a very cheap or no-name Android phone from an unfamiliar seller, treat it as potentially compromised from the moment you unbox it.
- Check Settings > Apps for apps you never installed, and look for unusual battery, data, or temperature drain.
- Prefer phones from reputable manufacturers with genuine firmware and an established update track record.
- Be cautious when using a brand-new budget phone for work, banking, or any account you want to keep secure.
The bigger signal is how the threat is delivered: through the supply chain, not the user. When malware arrives already baked into the hardware, the ordinary “just don’t download shady apps” advice stops being enough — the safest fix is to buy from a trustworthy manufacturer in the first place.
Sources: BleepingComputer — “Malware preinstalled on low-cost Android phones found across 150+ countries” (Lawrence Abrams, Oct 8, 2026); Help Net Security — “Low-cost Android phones are arriving with malware that owners can’t uninstall” (Oct 12, 2026); Bitdefender — “The phone was compromised before the user turned it on: the rise of Midnight Mimosa” (primary research, Oct 8, 2026).
Corrections: Report an error at corrections@wireshaman.com.