Bitdefender Finds Malware Preinstalled on Cheap Android Phones
Security researchers at Bitdefender have identified a campaign called Midnight Mimosa that infects low-cost Android devices with malware hidden in the firmware before users even turn them on. The malicious software has been observed on thousands of devices in more than 150 countries, including the United States.
Security researchers at Bitdefender have uncovered a malware campaign that infects low-cost Android smartphones before their owners even turn them on, embedding malicious software deep inside the device firmware. The campaign, dubbed Midnight Mimosa, gives attackers powerful system-level access that ordinary apps never receive, according to the company's investigation.
The malware was found on multi-brand Android devices built around MediaTek chipsets. Because the malicious code lives in the system partition, a standard uninstall cannot remove the underlying infection. The researchers identified several versions hiding behind innocuous package names such as com.android.system.lite, com.android.sys.prot and com.android.sys.gmsprot, which are designed to look like legitimate technical components.
Bitdefender says it observed Midnight Mimosa on thousands of unique devices across more than 150 countries over roughly two years. Mexico, France and Italy recorded the highest numbers, followed by the United States, Germany, Brazil and Spain. Researchers also found related malicious apps on Google Play, extending the campaign's reach beyond preinstalled firmware.
The elevated privileges allow the malware to install additional apps without user permission, remove existing applications, grant sensitive access to other software and download and execute new code from remote servers. Some infected devices reported model names associated with Doogee's S200 X and Cubot's KINGKONG X, though the findings do not establish that every phone sold under those names is affected. Some devices in the campaign use misleading or counterfeit model identifiers, making it difficult to identify infections based on a phone's reported name alone.
Another part of the investigation uncovered devices pretending to be expensive smartphones. Some reported names resembling Samsung Galaxy flagship models, while others imitated Apple's iPhone naming. In other words, a phone advertised as a premium Samsung or Apple device might actually contain inexpensive Android hardware running modified software. Researchers found that some counterfeit devices even reported legitimate-looking Samsung model identifiers, making model-name checks an unreliable way to confirm authenticity.
The investigation also identified firmware signed with certificates associated with Shenzhen Zediel, a Chinese device manufacturer. Bitdefender emphasized that this does not establish that the company created the malware or knew about its presence. Exactly where the malicious code entered the manufacturing and distribution process remains unknown.
Rather than stealing passwords immediately or displaying obvious warnings, Midnight Mimosa appears primarily designed to generate money for its operators while staying out of sight. One method is advertising fraud: the malicious system component silently installs apps that look like weather tools, app lockers and other everyday utilities. Those apps can display legitimate advertisements in hidden windows or generate clicks without the owner touching the screen, leaving advertisers to pay for activity that never came from a real person. Bitdefender identified at least 32 unique disguised applications involved in the broader operation, and the malware can repeatedly install and remove them to avoid casual detection.
Researchers also discovered software that can turn infected phones into residential proxy servers. An operator could route internet traffic through a victim's phone connection, making it appear to websites and online services that the traffic originates from the user's home or mobile network rather than the person actually controlling it. Such connections are valuable to cybercriminals because they help conceal where online activity originates, and the same infrastructure could potentially support larger botnet operations or distributed denial-of-service attacks. Bitdefender confirmed the malware contained the technology needed to turn infected phones into residential proxy servers, though researchers later clarified that one server they reached was a sinkhole used to intercept malicious communications.
The findings underscore a risk that conventional smartphone security advice does not address. Most guidance focuses on avoiding malicious downloads, but Midnight Mimosa shows that the infection can arrive with the phone itself. For bargain hunters, the campaign is a reminder that unusually low prices on devices advertised as premium hardware can signal counterfeit components or modified software rather than a genuine deal.
8
