Midnight Mimosa malware found preinstalled on budget Android phones

Shoppers who buy low-cost Android phones from online marketplaces may be getting malware that was planted on the device before it ever reached them, Bitdefender has found. The Midnight Mimosa malware campaign runs on budget Android phones from several brands built on MediaTek platforms. The malicious code ships inside the firmware, is already there when the owner first switches the phone on, and can’t be uninstalled.

“The compromise is complete before the phone is first switched on,” Bitdefender noted.

“The malware runs with system-level privileges that allow it to silently install and remove apps, grant permissions, and load arbitrary code supplied remotely. This essentially means its operators could install and delete apps at will, tuning each device to their needs, including making them part of large botnets.”

Bitdefender says the scheme is probably built to make money.

“The operators carry out ad and click fraud, collect device and installed-app information, and turn infected devices into residential-proxy relay nodes, making them zombies in botnets. This creates an additional revenue stream, as access to botnets for DDoS attacks is a hot commodity. The larger the botnet, the more money they can charge,” they added.

Midnight Mimosa was seen on thousands of unique devices in more than 150 countries. Mexico, France and Italy top the list, followed by the United States, Germany, Brazil and Spain.

You May Also Like

Recommended

1

Midnight Mimosa malware comes preinstalled on low-cost MediaTek Android phones

2

Galaxy S27 Ultra display could fix the Privacy Display trade-offs

3

WhatsApp’s Restricted Chat blocks linked devices from accessing a conversation

Some of the affected models are counterfeits that borrow flagship names. Their model strings include “i17 Pro Max”, “S25 Ultra”, “S24 Ultra” and “Note 18 Ultra”, and certain devices not made by Samsung report the Galaxy S25 Ultra model code SM-S938B.

The Doogee S200 X and the Cubot KINGKONG X are the two most common models among infected devices. On the XDA forum, Cubot and Doogee owners described suspicious apps that kept reinstalling themselves after being removed.

How Bitdefender found Midnight Mimosa

The investigation started when Bitdefender’s App Anomaly Detection flagged com.android.system.lite for acting unlike a system component. It repeatedly turned on Accessibility and Notification Access, and silently installed and removed unrelated apps.

One of those apps, com.mobile.applock.wt, presented itself as an app lock but contained no app lock code and stayed hidden from the user. It proved to be a heavily obfuscated dropper, although it was not the root cause of the infection.

The system app was platform-signed, and its malicious code sat in a native library that only became active at runtime. Since the app came preinstalled, the researchers say observing its behavior was the only way left to catch it.

A hidden app labeled “System”

The app uses the label “System”, has no icon, and never shows up in the launcher. It runs as the system user and downloads more code from a command and control (C2) server.

Bitdefender calls this component the enabler, because it installs and controls the apps that carry out the fraud. The same code also ships under other names, including com.android.sys.prot, com.android.sys.gmsprot and com.android.sys.bcprot.

The malware sends the phone’s IMEI, Android ID, MAC address and timezone to its C2 server, and grants itself Accessibility, Notification Access and SMS permissions. Bitdefender did not see these permissions used during its analysis, but the operators can use them on demand.

Accessibility access lets an app read everything on screen, watch what the user types and tap through apps for the owner. Notification Access exposes chat messages, while SMS access allows reading one-time codes and sending texts to premium numbers. The researchers also note that the code the malware loads comes from a server whose operators have a history of premium SMS subscription fraud.

Ad fraud and detection evasion

The system app installs and removes a rotating set of at least 32 disguised apps, including weather, app lock, note-taking, OCR, file manager and audio editing tools. These cover apps carry a legitimate ad SDK, and they are what the ad network sees and pays for.

A hidden plugin then displays ads the owner never asked for, in windows that cover the screen or appear over other apps, such as when the display turns on. Those windows are flagged as secure, a setting meant to keep banking screens out of screenshots, so owners can’t capture them in a screenshot or screen recording. Settings pushed from the C2 server control how often a click registers with no user touch and where on the ad the fake tap lands, which makes the traffic look human.

The same ad-fraud code also appeared in 13 apps on Google Play that talk to the same servers as the preinstalled malware. They passed Play review and reached people who were simply looking for a weather app or a QR scanner. They lack the system-level rights of the preinstalled version, yet they still show ads outside the app, sometimes while the phone isn’t in use.

The apps were signed with 13 different certificates and published under at least two developer accounts, fivedev and CPS Developer.

“The link between them is the shared code, not the certificate. An actor who rotates signing identity per package is anticipating that any one of them will eventually be burned,” Bitdefender explained.

Just before installing one of these apps, the malware disables the Google Play Store app, which hosts Play Protect’s on-device scanner, then switches the store back on once the install finishes. A separate safeguard re-enables the Play Store when the user is present, so as not to raise suspicion.

Some samples also list Google Play as their install source even though they never came from the store. The giveaway is a missing signature block, which Google adds to apps distributed through Play.

Why owners have no easy fix

On some devices, the system app was signed with a certificate bearing the name of Shenzhen Zediel, a Chinese Android device maker. Bitdefender stresses that this does not prove the company wrote or distributed the malware, or knew about it. Phones without Zediel-signed firmware carry the same malware.

“The malware ships with the device. What remains unclear is at which point in the supply chain it is integrated. It could be introduced by an ODM, a firmware integrator, a logistics partner, or another actor further down the distribution chain,” researchers stated.

Because the malware lives in the system partition, owners can’t remove it the usual way. Cleaning it up requires firmware-level work or disabling the component through Android Debug Bridge (ADB), a developer tool that controls the phone from a computer, and Bitdefender says neither is realistic for most owners of these phones.

“The durable fix sits with the vendors and the marketplaces that ship and sell the affected firmware,” Bitdefender concluded.