Bitdefender researchers identified a malware campaign they call Midnight Mimosa on some low-cost Android devices, according to the investigation described in the supplied report. The malicious code is embedded in device firmware, rather than arriving only through an app a user chooses to download. That placement can give it elevated privileges and make it difficult to remove through ordinary app-uninstall steps.
The researchers said they observed the malware on thousands of devices in more than 150 countries over about two years. Mexico, France and Italy had the highest observed counts, followed by the United States, Germany, Brazil and Spain. Some infected devices reported model names associated with Doogee’s S200 X and Cubot’s KINGKONG X. Bitdefender’s findings do not mean every phone sold under those model names is infected. The report also cautioned that some devices used misleading or counterfeit model identifiers, so a displayed model name may not reliably establish what hardware a phone contains.
According to Bitdefender, the system-level malware can install additional applications, remove apps, grant permissions and download or run code from remote servers. Researchers found several suspicious package names that resembled ordinary Android system components. Because the code resides in the system partition, deleting an individual app may not remove the underlying infection.
The campaign appears to include advertising fraud. Bitdefender identified at least 32 disguised applications associated with the broader operation. Some could generate advertising activity in the background, including displaying ads in hidden windows or producing clicks without the phone owner’s interaction. The malware could also repeatedly install and remove apps, making them less obvious to a user checking the device.
Researchers also found technology that could turn infected phones into residential proxy servers, routing outside users’ internet traffic through a device’s connection. Bitdefender said this capability could help conceal the origin of online activity. The report makes an important distinction: researchers did not demonstrate active traffic being relayed through an infected phone. A server they contacted was a sinkhole used to intercept malicious communications. The proxy capability was present, but its use was not confirmed in their testing.
The investigation identified firmware signed with certificates associated with Shenzhen Zediel, a device manufacturer. Bitdefender said that finding does not show the company created the malware or knew it was present. Researchers have not determined how or where the malicious code entered the production or distribution process.
Bitdefender also found related applications that had been listed on Google Play, offering functions such as weather information, QR scanning, message recovery and audio editing. The researchers said those apps could produce unwanted advertising activity, but did not have the elevated system privileges of the firmware malware. At the time of the report, none of the 13 app listings checked was available for download. It was unclear whether Google removed them or developers withdrew them, and Google had not responded to the publication’s request for comment before its deadline.
The report described several ways to investigate a suspicious Android phone, while warning that a clean scan cannot rule out compromised firmware. Users can review installed apps, permissions and data use, and check whether Google Play Protect is enabled. Unfamiliar app names alone are not proof of infection, and the report cautioned against disabling legitimate system components at random. It also advised buying through established sellers and verifying a device’s model and specifications with the manufacturer.
Bitdefender said removal may require firmware-level cleanup or specialized tools. A factory reset may erase personal information and user-installed apps without replacing compromised system software. The report advises owners who suspect firmware tampering to contact the manufacturer and use verified support channels; if a device cannot be restored with clean firmware, replacing it may be a practical option. These are precautions, not confirmation that any particular phone is infected.
