Some cheap Android phones are infected before their owners switch them on. Security firm Bitdefender has documented a campaign it calls Midnight Mimosa: preinstalled malware on Android phones built on MediaTek chips, found on thousands of devices in more than 150 countries over roughly two years. The malicious code sits in the phone’s firmware and cannot be removed with a normal uninstall. As Bitdefender’s researchers put it, “It’s on the phone before the owner switches it on for the first time, and it can’t be uninstalled.”
How it was found
The investigation started when Bitdefender’s mobile security app flagged a system app called com.android.system.lite. It looked like part of Android, carried a generic “System” label and hid its icon, but it kept enabling sensitive permissions and quietly installing and removing other apps. “Behavior was the only thing left to catch it by,” the researchers wrote.
The same core code ships under several names designed to look official, such as com.android.sys.prot and com.android.sys.gmsprot. It is signed with the phone maker’s platform key, which gives it system-level privileges, the same level as Android itself.
What it does
The main business is ad fraud. The malware loads code that generates fake ad views and clicks in the background, which earns money for whoever runs it. It can also install and remove other apps and grant them permissions without asking the owner.
Some infected phones are turned into “residential proxies.” That means strangers can rent the phone’s internet connection and send their own traffic through it, so it looks as if it comes from an ordinary home. Criminals use such networks to hide fraud and attacks, and Bitdefender notes the same setup could be used for DDoS attacks, which flood a website with traffic until it fails.
The malware also gives itself access to accessibility features, notifications and text messages. Bitdefender did not see those permissions being used, but says the operator could switch them on remotely at any time, because it can push new code from its servers.
One detail shows how carefully it hides. Before installing anything, it switches off the Google Play Store app, which hosts Google’s built-in malware scanner, Play Protect, and turns it back on afterwards. Bitdefender also found the same ad-fraud code in 13 apps on Google Play, published under at least two developer accounts and talking to the same servers.
Which phones
The infected devices are low-cost phones from lesser-known brands and imitations of famous ones. The two models seen most often report themselves as “S200 X,” associated with Doogee, and “KINGKONG X,” associated with Cubot. Others claim to be flagship phones, such as “S25 Ultra” or “i17 Pro Max.” Bitdefender warns that these names can be faked, so they are clues, not a definitive list. The most affected countries were Mexico, France and Italy, followed by the United States, Germany, Brazil and Spain.
Bitdefender does not accuse MediaTek of anything; its chips are simply common in budget phones. It did trace the signing key used on the infected firmware to Shenzhen Zediel Co., but stresses that this shows only which certificate was used, not who wrote or distributed the malware.
Not the first time
Midnight Mimosa looks a lot like BADBOX 2.0, a separate operation the FBI warned about in a public service announcement in June 2025. That botnet involved “millions of infected devices,” mostly cheap streaming boxes, projectors, car entertainment units and digital picture frames, many made in China. Some came infected from the factory; others were infected during setup. They too were used as residential proxies. The two campaigns have not been linked, but they share a business model: sell hardware cheaply, then earn money from it after the sale.
How to protect yourself
- Check Play Protect certification. In the Play Store app, open Settings, then About, and look for “Play Protect certification.” The FBI lists uncertified Android devices as a warning sign.
- Be wary of prices that look too good. A phone named like a flagship but selling for a fraction of the price is very likely a counterfeit.
- Watch for requests to disable security. A device or app that asks you to turn off Play Protect is a red flag, according to the FBI.
- If you own an affected model, do not rely on uninstalling apps. Contact the seller or manufacturer about a firmware fix, a refund or a replacement.
Cheap hardware is not the only bait; a low price or a convincing offer is behind many of the AI scams costing Americans hundreds of millions this year. And the problem of unfixable flaws in hardware people trust is not limited to phones, as the 16-year-old Broadcom router bug shows.
Our take
Buyers cannot inspect firmware, so telling them to “be careful” only goes so far. The real checkpoint is the marketplace. An online store that lists Android phones should be able to show whether each model is Play Protect certified, and should stop selling models that security researchers have found shipping with malware. Until that happens, the safest rule for consumers is simple: if a phone carries a famous model name and a no-name price, assume someone else is making up the difference.