Midnight Mimosa: preinstalled malware on cheap Android phones, 150+ countries

Bitdefender documented a malware campaign it tracks as Midnight Mimosa: malicious code preinstalled in the firmware of low-cost Android phones, found on thousands of unique devices across more than 150 countries over roughly two years. Because the code lives in the read-only system partition, a user cannot uninstall it — fixing it requires a firmware update from the vendor or marketplace.

The primary source is Bitdefender Labs' write-up, Midnight Mimosa.

What's affected

• Devices: Android phones built on MediaTek platforms, largely low-cost, white-label or counterfeit handsets — including models that borrow the names of Samsung Galaxy phones and iPhones. Bitdefender does not name specific legitimate models.
• Firmware signing: affected firmware was signed with certificates attributed to Shenzhen Zediel Co., Ltd. Bitdefender says it is "unclear" whether that company was involved or aware.
• Top countries by infection: Mexico, France, Italy, then the United States, Germany, Brazil and Spain.

MediaTek is the common platform, not the culprit — there is no claim that every phone with a MediaTek chip is at risk.

What the malware does

The core package — first seen as com.android.system.lite, with sibling builds com.android.sys.prot, com.android.sys.gmsprot and com.android.sys.bcprot under different signing certs — runs with system-level privileges. It can:

• Install and remove a rotating set of at least 32 disguised apps, grant itself accessibility, notification and SMS permissions, and load remotely-supplied code.
• Disable the Google Play Store before installing a payload — closing the window in which Play Protect would scan — then re-enable it.
• Run ad and click fraud: cover apps load real ads through a legitimate ad SDK while a hidden overlay registers the impressions, so the ad network credits the cover app. Bitdefender's read is that revenue is the primary goal.

On the residential-proxy angle, keep the hedge the primary source keeps. One payload (com.mobile.applock.en) is a TCP proxy that connects to a control host on port 6000 and relays traffic to attacker-named targets — the capability to enrol devices as proxy relay nodes and botnet members is in the code. Bitdefender describes the mechanism rather than claiming it captured large-scale live proxy traffic, and notes one previously-reported IP turned out to be a sinkhole, not a C2.

Detection

Bitdefender did not publish file hashes or C2 domains in a consolidated IOC block. It did name 13 Google Play apps found communicating with the same servers — among them Wavrge (com.audify.editor.wavrge), QR Pocket (com.prorestore.qr) and WeatherGo (com.go.weather.mot); the full list is in the report. None are currently on the Play Store.

Action checklist

1. In a BYOD or fleet context, block the named packages. Flag com.android.system.lite, com.android.sys.prot, com.android.sys.gmsprot, com.android.sys.bcprot and the listed Play Store apps in your MDM/EMM.
2. Treat ultra-cheap, off-marketplace Android handsets as untrusted for any access to corporate resources. A factory reset does not remove firmware-resident code.
3. For affected consumers, the realistic remediation is a vendor firmware fix or replacing the device; the malware survives a reset.
4. Watch for the behavioural tells: a device that disables and re-enables Play Store, requests accessibility/SMS without cause, or carries pre-loaded "system" apps you didn't install.

Context

Preinstalled, firmware-resident Android malware in the cheap-device supply chain is a recurring pattern — Bitdefender notes infrastructure overlap with Android.Phantom, documented by Doctor Web in January 2026, and the broader lineage runs through BADBOX-style operations that enrol budget devices as proxy fleets. The through-line: the attack happens before the box is opened, which puts the fix with manufacturers and marketplaces, not users. Extra skepticism is warranted on the proxy-botnet framing until a vendor publishes measured traffic volumes — the ad-fraud revenue engine is the part Bitdefender documents most concretely.