The phone ships infected
In October 2026, Bitdefender researchers disclosed Midnight Mimosa: malware preinstalled in the firmware of cheap, multi-brand Android phones built on MediaTek chips. The code is on the device before the owner turns it on for the first time and cannot be uninstalled by normal means.
What it does
According to Bitdefender and coverage from SecurityWeek, Android Authority and Security Affairs, Midnight Mimosa runs as a platform-signed system app and can:
- silently install and remove apps and grant permissions;
- run ad and click fraud;
- turn the device into a residential-proxy node in a botnet;
- load code remotely from a command-and-control server;
- per Android Authority, evade Play Protect.
Scale and devices
Over roughly two years, the family was seen on thousands of unique devices in more than 150 countries. Mexico, France and Italy lead, followed by the US, Germany, Brazil and Spain, with a long tail across Africa, Southeast Asia and the Middle East.
The most common models are the Doogee S200 X and Cubot KINGKONG X. Bitdefender also saw fake flagship names such as "S25 Ultra", "S24 Ultra" or "i17 Pro Max" on devices imitating premium brands. An XDA forum thread describes a hidden com.android.sys.* package that came back under another name after removal.
Note: Bitdefender stresses that the research concerns a specific campaign and ecosystem. Affordable phones from reputable makers remain safe choices.
Why this is different
"Preinstalled malware is a different threat class," the report says. Every user-facing defense assumes the owner is in the loop at install time: the install prompt, store review, Play Protect and the ability to uninstall. None of that applies here. It is a supply-chain attack.
What to do
Users:
- Uninstalling or factory reset won't fix it, because the code lives in the system partition.
- Ask the seller for a refund or replacement, and buy from recognized brands and retailers.
- Don't flash unofficial firmware promising a quick fix.
Businesses:
- Don't let "generic" marketplace phones access corporate email, chat or VPN.
- Use MDM with an approved-model list and device integrity attestation.
- On corporate networks, watch for anomalous proxy traffic from phones.
Sources
- Bitdefender Labs: https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware
- SecurityWeek (Oct 9, 2026): https://www.securityweek.com/pre-baked-firmware-malware-hits-budget-android-devices-in-150-countries/
- Android Authority: https://www.androidauthority.com/midnight-mimosa-malware-android-phones-3720493/
- Security Affairs: https://securityaffairs.com/200759/malware/bitdefender-finds-preinstalled-android-malware-you-cant-uninstall-seen-in-150-countries.html
Need a secure mobile device policy for your team? KGA IT offers a free consultation: kga-it.com.