Bitdefender Finds Uninstallable Malware in Budget Android Phones
Bitdefender discovered the Midnight Mimosa campaign, which embeds persistent malware in the firmware of low-cost Android devices sold online.
Key points
- The malware ships pre-installed in device firmware and cannot be removed by users.
- It operates with system-level privileges to install apps and collect data silently.
- Thousands of infected devices were detected across more than 150 countries.
Bitdefender researchers have identified a widespread malware campaign targeting budget Android smartphones sold through online marketplaces. The threat, named Midnight Mimosa, is embedded directly into the device firmware before the owner ever powers on the phone. This pre-installed compromise ensures the malware persists regardless of user actions or standard security measures.
The malicious code runs with system-level privileges, granting operators the ability to silently install or remove applications. It can also grant permissions and load arbitrary code supplied remotely. According to Bitdefender, this access allows threat actors to tune each device for their needs, potentially incorporating them into large botnets for illicit activities.
Campaign Mechanics and Scope
Bitdefender states that the campaign is likely designed to generate revenue through ad fraud and click fraud. The malware collects device information and details about installed applications. It also turns infected devices into residential-proxy relay nodes, effectively making them zombies in botnets. Access to these botnets for distributed denial-of-service attacks is described as a hot commodity, with larger networks commanding higher prices.
The investigation began when Bitdefender’s App Anomaly Detection flagged the component com.android.system.lite. This component behaved unlike a standard system part by repeatedly enabling Accessibility and Notification Access. It also silently installed and removed unrelated apps, including com.mobile.applock.wt, which posed as an app lock but remained hidden from the user.
Affected Devices and Regions
The campaign was observed on thousands of unique devices across more than 150 countries. Mexico, France, and Italy lead the list of affected regions, followed by the United States, Germany, Brazil, and Spain. The malware targets budget Android devices from various brands built on MediaTek platforms. Many of the affected models are counterfeits that borrow names from flagship smartphones.
Model strings found on infected devices include “i17 Pro Max,” “S25 Ultra,” “S24 Ultra,” and “Note 18 Ultra.” Some devices not manufactured by Samsung report the Galaxy S25 Ultra model code SM-S938B. The two most common models among infected devices are the Doogee S200 X and the Cubot KINGKONG X. Owners of these phones on the XDA forum reported suspicious apps that reinstalled themselves after removal.
What should you do?
No patch or fix has been confirmed yet for devices already compromised by this firmware-level malware. Users who suspect their device is infected should monitor for unexpected app installations or changes in accessibility settings. Because the malware cannot be uninstalled, affected users may need to replace the device entirely to ensure security.
What to do and how to stay safe: Bitdefender
- Avoid purchasing low-cost smartphones from unauthorized online marketplaces or third-party sellers.
- Check if your device reports a model name that does not match its physical branding.
- Monitor for apps that reinstall themselves after being deleted from the device.
- Watch for unexpected changes to accessibility services or notification access permissions.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Can I remove the Midnight Mimosa malware from my phone?
No, the malware is embedded in the device firmware and cannot be uninstalled by the user.
Which countries have the most infected devices?
Mexico, France, and Italy lead the list, followed by the US, Germany, Brazil, and Spain.
What brands are affected by this campaign?
The campaign targets budget Android devices from different brands built on MediaTek platforms.
