Bitdefender has identified a malware campaign called Midnight Mimosa that infects low-cost Android devices before their owners first power them on. The malicious software is embedded in the phone's firmware, granting attackers elevated privileges that standard applications do not possess. This infection vector bypasses typical security measures that rely on user behavior, such as careful app selection, because the threat arrives with the hardware itself.
The campaign primarily targets budget smartphones built around MediaTek chipsets. Researchers found the malware hiding behind innocuous package names, including com.android.system.lite and com.android.sys.prot, which mimic legitimate system components. These privileges allow the malware to install additional software without user permission, remove existing applications, and download new code from remote servers. Because the code resides in the system partition, standard uninstall procedures fail to remove the underlying infection.
Bitdefender observed the malware on thousands of unique devices across more than 150 countries over a two-year period. Mexico, France, and Italy recorded the highest observed numbers, followed by the United States, Germany, Brazil, and Spain. Infected devices reported model names associated with Doogee's S200 X and Cubot's KINGKONG X, though the findings do not establish that every phone sold under those names is affected. Some devices in the campaign used misleading or counterfeit identifiers, with some mimicking Samsung Galaxy flagships or Apple iPhones to appear as premium hardware.
The malware's primary function is financial gain through advertising fraud. It silently installs disguised applications that look like weather tools or utilities but generate ad clicks and display ads in hidden windows. Bitdefender identified at least 32 unique disguised applications involved in this operation. The malware can also repeatedly install and remove these apps to avoid detection. Additionally, researchers found the capability to turn infected phones into residential proxy servers, which could allow operators to route internet traffic through the owner's connection to conceal their location. However, Bitdefender clarified that their testing did not demonstrate active traffic being relayed through the infected devices, as one server they reached was a sinkhole used to intercept malicious communications.
To evade detection, Midnight Mimosa temporarily disables the Google Play Store app before installing malicious software, preventing Google Play Protect from scanning the new applications. Some versions also manipulate installer records to make apps appear as if they came from Google Play. Researchers identified 13 specific apps on Google Play associated with this campaign, including Wavrge and CoolWeather. These apps lacked the elevated system privileges of the firmware malware but could still generate unwanted advertising activity. Checks of Google Play listings found that none of these 13 apps were currently available for download, though it remains unclear whether Google removed them or developers withdrew them.
The investigation links these findings to user complaints on XDA forums regarding Doogee and Cubot smartphones. Users reported suspicious system applications that reappeared after removal attempts. One Doogee Fire 3 Max owner stated that an official firmware update introduced the infection, which was resolved by reverting to an older version. Bitdefender confirmed that one suspicious package discussed in these forums, com.android.non.szcz, belongs to the same malware family.
Firmware signed with certificates associated with Shenzhen Zediel was identified in the campaign. Bitdefender emphasized that this does not establish that Zediel created the malware or knew of its presence. The exact point at which the malicious code entered the manufacturing or distribution process remains unknown.