Midnight Mimosa: Budget Android phones ship with malware baked into the firmware
A Bitdefender analysis finds malware embedded below the app layer in low-cost MediaTek phones. It grants operators the power to install apps at will and quietly harvest ad-fraud revenue and botnet capacity before the owner ever powers the device on.
Bitdefender has detailed a malware campaign it calls Midnight Mimosa, built to live in the firmware of low-cost Android smartphones long before the first user ever switches one on. When an owner powers up an affected phone, the malicious system app is already present and running with system-level privileges that ordinary users cannot see or remove.
Why this is different
Most Android malware arrives through a Play Store install or a sideloaded APK. Midnight Mimosa sidesteps that layer entirely. It ships preinstalled in the device firmware on phones built around MediaTek chipsets, from budget brands such as Doogee and Cubot to counterfeit devices reporting themselves as models like an “S25 Ultra” or “i17 Pro Max.” Because it sits below the normal app-installation boundary, “every user-facing defense had already been bypassed” by the time the phone is switched on, according to Bitdefender’s analysis.
The privileges are what make it dangerous. The malware can silently install and remove apps, grant itself permissions, and load arbitrary code supplied remotely from a command-and-control server. In practice that means operators can tune each device to their needs at will — installing ad-fraud tooling, converting the phone into a residential proxy or DDoS node, or folding it into a large botnet they can rent out. It also targets advertising revenue: it installs apps for functions such as weather, AppLock, notes and OCR that use legitimate ad SDKs while running ads in the background to generate fake impressions and clicks without the owner ever seeing them.
A two-year, worldwide footprint
Bitdefender observed thousands of unique affected devices across more than 150 countries over roughly the last two years, with no single region dominating. Mexico, France and Italy lead the distribution, followed by the United States, Germany, Brazil and Spain, with a long tail across Africa, Southeast Asia and the Middle East. Bitdefender says it also found the same ad-fraud code in 13 Google Play apps, indicating the operation is not limited to preinstalled firmware alone.
Because the code lives in firmware and holds system-level control, a standard “uninstall app” does nothing. The only reliable way to remove it is to reflash the device with clean software — which is often impractical on cheap, obscure hardware that never receives manufacturer updates. That combination of persistence and invisibility makes it one of the more tenacious forms of mobile supply-chain malware yet documented.
If you buy a very cheap Android phone from an online marketplace or a brand you have never heard of, assume it may already be compromised. Prefer established manufacturers that ship Google updates, avoid devices whose advertised RAM and storage look suspiciously high for the price, scan for unfamiliar “system” apps and background ad activity after purchase, and treat a suspiciously cheap handset as a risk to your accounts and data — not just to your bank balance.
Sources: Bitdefender — Midnight Mimosa analysis; SecurityWeek — Pre-Baked Firmware Malware Hits Budget Android Devices; PCMag — Malware Found Preinstalled on Cheap, Counterfeit Android Phones.
Corrections: Report an error at corrections@wireshaman.com.