Midnight Mimosa Malware Targets Budget Android Phones

Bitdefender researchers have uncovered a firmware-level malware campaign on low-cost MediaTek Android devices. The malware — called Midnight Mimosa — arrives before the phone is ever switched on, and the owner cannot remove it.

The phone is already compromised when the box is opened. That's the defining feature of the malware campaign Bitdefender is calling Midnight Mimosa, and it's what separates this from the usual story about a sketchy app downloaded from a third-party store. The malware ships in the firmware of low-cost Android smartphones — primarily devices built on MediaTek chipsets — and runs with system-level privileges that no user-installed application can match [1].

Bitdefender published its technical analysis on October 8, 2026. The researchers found the malware preinstalled across multiple device brands and model lines, including phones impersonating Samsung and Apple flagship models, as well as genuine budget brands Doogee and Cubot. The campaign's stated objectives: ad and click fraud, device data collection, and turning infected phones into residential proxy nodes for botnets [1].

What Midnight Mimosa Actually Does

Midnight Mimosa centers on a single persistent system application, com.android.system.lite, that ships already signed for the platform — meaning it has the same level of trust as a genuine Android OS component. It declares sharedUserId="android.uid.system" in its manifest and holds permissions that normal apps cannot obtain: INSTALL_PACKAGES, DELETE_PACKAGES, GRANT_RUNTIME_PERMISSIONS, and the ability to write to secure system settings [1].

The app itself is largely hollow. Its real machinery lives inside a bundled native library, libeasy.so, which RC4-decrypts a hidden APK at runtime and loads it as a privileged framework in the system process. That framework then contacts a command-and-control server at api.weatherlive.world, retrieves a configuration, and downloads encrypted stage-2 and stage-3 plugins served as .png files from a CDN. The payload is never present in the static APK, which means basic file scanning catches nothing [1].

Bitdefender's App Anomaly Detection caught it by watching behavior: the app was silently installing and removing other applications, repeatedly granting itself accessibility and notification access, and doing so with no user interaction whatsoever [1].

How the Ad Fraud Works

The fraud mechanism is deliberately indirect. The enabler app itself doesn't register any fake ad impressions — it holds no ad SDK and would produce clicks that attribute to nothing. Instead, Midnight Mimosa silently installs a rotating portfolio of cover apps: weather tools, app lockers, note apps, OCR utilities. These carry legitimate advertising SDKs, so when the fraud plugin renders invisible ad windows and fires synthetic clicks, the revenue flows to the cover app's ad unit [1].

The click fraud is parameterized from the C2. A remote configuration specifies what percentage of ads get a synthetic click with no real user touch (silentPercent), minimum intervals between fabricated clicks, and even where on the ad creative the fake tap should land to look plausible. Sixty seconds after an ad is displayed, a "conversion" event is uploaded with an explicit silent=true flag — meaning the operator knows exactly which events have no human behind them. The ad network doesn't [1].

One particularly clean evasion: the malware disables com.android.vending (the Play Store, which hosts Play Protect's real-time scanner) immediately before installing a payload app, then re-enables it once installation completes. The scanner is switched off for exactly the window it would need to catch the install [1].

The Residential Proxy Component

Beyond ad fraud, Midnight Mimosa deploys a separate proxyware payload called com.mobile.applock.en — a fake "Locket" app-lock shell with no UI and no real functionality. It contains a single-purpose TCP back-connect relay that registers the device with a control server, receives a list of relay targets, and pipes traffic bidirectionally between the C2 and those targets [1].

Each infected device enrolls with a unique UUID, a product/campaign identifier, and a device fingerprint. The control infrastructure rotates across four domains under wildcard DNS, each resolving to a C2 listening on port 6000. Bitdefender confirmed the C2 was live and accepting node registrations during their analysis — though the researchers noted that on a freshly enrolled node, no relay targets were immediately pushed, and they later determined the IP observed was a sinkhole rather than an active operator server [1].

What this means in practice: an owner's home IP address becomes an exit node for traffic they know nothing about. Residential proxies are sold commercially for web scraping and bypassing geo-blocks, but they're also used for credential stuffing attacks, account fraud, and routing traffic from other malicious operations through what appears to be a legitimate home connection.

Affected Devices and Scale

Bitdefender's telemetry recorded Midnight Mimosa across more than 150 countries over roughly a two-year observation window, with detections concentrated in Mexico, France, and Italy, followed by the United States, Germany, Brazil, and Spain [1].

The spread pattern itself tells a story. Bitdefender notes that a single dominant country would suggest a regional distribution channel — a carrier or national retailer. Two separate concentrations (Western Europe and the Americas) with a long tail behind them points to hardware moving through international online marketplaces. The cheap phones reach buyers everywhere because they're sold everywhere.

The specific device models fall into distinct patterns:

Device patterns observed in Midnight Mimosa telemetry. Source: Bitdefender Labs [1].

Bitdefender found that firmware on affected devices was signed using certificates attributed to Shenzhen Zediel Co., Ltd., a Chinese Android OEM. The company's IEEE MAC OUI (A0:53:94) provides a network-level indicator that could identify affected devices in enterprise telemetry. That said, Bitdefender explicitly notes that it cannot confirm whether Zediel was responsible for or even aware of the malware integration — and the same malware core appears on devices with entirely different firmware signing certificates [1].

Google Play Is Also Affected

Midnight Mimosa has two separate distribution channels, and the firmware route is only one of them. Bitdefender identified 13 applications on the official Google Play Store carrying the same ad-fraud family markers as the dropped cover apps — weather tools, QR scanners, note apps, audio editors — published under at least two developer accounts with 13 different signing certificates [1].

These Play Store builds are genuine Play-distributed apps — they carry Google's Play signature block, which confirms they went through Play review and weren't sideloaded. The rotating developer accounts and per-package signing certificates suggest deliberate anticipation that any individual app will eventually be removed [1].

The difference from the firmware variant is one of capability. Apps installed via Play can't hold INSTALL_PACKAGES or GRANT_RUNTIME_PERMISSIONS at the system level, so they can't silently install other apps or act as an enabler. They can, however, communicate with the same C2 infrastructure and run the ad-fraud logic against their own ad units. The Play channel catches users who bought a perfectly normal device; the firmware channel catches users who bought a cheap one [2].

Where This Fits in the Bigger Picture

Midnight Mimosa isn't the first campaign to follow this playbook. Bitdefender traces its operator lineage through Android.Phantom (documented by Dr.Web, focused on click fraud) back to Android.Joker variants from 2021 that ran premium-SMS subscription fraud [1]. What's new in this iteration is the addition of residential proxyware on top of the existing ad-fraud stack, and the confirmed presence on firmware rather than just sideloaded or Play-distributed apps.

The broader Android firmware malware problem has a name most people in the space recognize: BADBOX. That campaign — which has gone through multiple disruptions, including a sinkholing operation by Google and HUMAN Security that took down communications for around half a million infected devices in early 2025 — targets the same class of Android Open Source Project (AOSP) devices that don't carry Google's Play Protect certification [3]. Bitdefender notes infrastructure overlaps with the Android.Phantom operator family that BADBOX-adjacent campaigns have also used, though it characterizes Midnight Mimosa as a distinct campaign rather than a direct BADBOX variant.

The underlying economics haven't changed. Devices built on AOSP and sold cheaply through online marketplaces arrive without Play Protect certification. Manufacturers or distributors somewhere in the supply chain have an incentive to load software that earns money after the hardware is sold at a loss. The buyer pays once; the operator continues to monetize indefinitely.

Can You Remove It?

Not through normal means. The enabler sits in the system partition of the device firmware, which means it has the same removal protection as a genuine operating system component. Clearing it would require firmware-level intervention — either flashing clean firmware or disabling the component via ADB — neither of which is realistic for most device owners [1].

Bitdefender is direct about this: "The durable fix sits with the vendors and the marketplaces that ship and sell the affected firmware." Individual owners can't remediate their way out of this one. Detection tools — like Bitdefender's own App Anomaly Detection that found it in the first place — can identify the behavior, but they can't excise a platform-signed system component [1].

What Remains Unknown

The question Bitdefender can't fully answer is exactly where in the supply chain the malware gets embedded. It arrives in the ROM before the phone is sold, but whether that happens at the ODM level, at a firmware integrator, at a logistics intermediary, or somewhere else in the distribution chain is outside the scope of the technical analysis they published. The certificate attribution to Shenzhen Zediel narrows the hardware picture somewhat, but Bitdefender is careful to separate certificate ownership from authorship or awareness of the malware [1].

Similarly, Bitdefender notes the enabler holds Accessibility Service and SMS read permissions that weren't observed being used during analysis — but those permissions remain "remotely armable" via the C2. The operator could push a module that uses them at any time. That's worth keeping in mind when evaluating the actual risk: what this malware does today and what it could be instructed to do tomorrow aren't the same question.

The campaign has been active for roughly two years according to Bitdefender's field telemetry. As of publication, no patch or remediation from affected device vendors has been publicly announced.

Sources & References

1. Bitdefender Labs — "The phone was compromised before the user turned it on: the rise of Midnight Mimosa" (October 8, 2026)
2. The Hacker News — "Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies" (October 13, 2026)
3. BleepingComputer — "BadBox malware disrupted on 500K infected Android devices" (2025)
4. Doctor Web — Android.Phantom malware analysis (referenced in Bitdefender's report)
5. XDA Forums — User report: hidden com.android.sys.* package on Cubot KINGKONG X reappearing after removal