Preinstalled Midnight Mimosa malware found on budget Android phones

Bitdefender says unremovable Midnight Mimosa firmware malware hit thousands of cheap Android phones in more than 150 countries.

Bitdefender disclosed Midnight Mimosa, malware preinstalled in the firmware of low-cost MediaTek Android phones—including Doogee S200 X, Cubot KINGKONG X, and counterfeit flagship-branded models—before first boot. A platform-signed system component, named by The Hacker News as com.android.system.lite, can disable the Play Store, silently install or remove at least 32 cover apps, and fetch further modules from infrastructure presented as a weather service. Operators monetize infections with ad and click fraud and by enrolling phones as residential proxies; GBHackers said payload com.mobile.applock.en relays TCP traffic on port 6000, while Cyber Security News said researchers did not observe live proxy relay. The activity hit thousands of devices in more than 150 countries over about two years, led by Mexico, France, and Italy; thirteen related Google Play apps were later removed, and firmware certificates were linked to Shenzhen Zediel. Sources disagree on data collection—Help Net Security says device data is collected, Cyber Security News says theft was not observed—and on DDoS, which Security Affairs describes as saleable botnet access but which GBHackers says was not confirmed. Because the component sits in the system partition, cleanup generally requires firmware remediation rather than a normal uninstall.

• Bitdefender disclosed Midnight Mimosa around October 8, 2026; follow-up reporting ran October 11–13.
• It is preinstalled in firmware on low-cost MediaTek Android phones, including Doogee S200 X, Cubot KINGKONG X, and counterfeit flagship-branded models, and survives ordinary uninstall.
• A platform-signed system component identified as com.android.system.lite installs or removes at least 32 apps, can disable the Play Store, and pulls further code from weather-themed infrastructure.
• GBHackers named payload com.mobile.applock.en as relaying TCP traffic on port 6000 for residential-proxy use; Cyber Security News said live proxy relay was not observed.
• Operators run ad and click fraud. Security Affairs said botnet access was pitched for DDoS; GBHackers said no DDoS campaign or named actor was confirmed.
• Thousands of devices in more than 150 countries were affected over about two years, led by Mexico, France, and Italy (one report said 150 countries).
• Thirteen related Google Play apps were removed, and firmware certificates were linked to Shenzhen Zediel. Help Net Security said device data is collected; Cyber Security News said theft was not observed.