Midnight Mimosa Malware Infects Thousands of Low-Cost MediaTek Android Phones

Midnight Mimosa malware has been found embedded in the firmware of some low-cost Android smartphones, giving attackers system-level control before buyers use the devices. Bitdefender researchers said the campaign affected thousands of phones across more than 150 countries over a two-year period, with the largest concentrations in Mexico, France, and Italy.

Key Points

• The campaign affects low-cost, multi-brand Android phones built on MediaTek platforms, including devices sold under Doogee and Cubot names.
• Bitdefender observed the malware on thousands of unique devices across more than 150 countries over roughly two years.
• The malware can silently install apps, grant permissions, commit ad fraud and route traffic through infected phones.
• Because the malware is embedded in firmware, ordinary app removal does not remove it; firmware cleanup or disabling the component through ADB may be required.

Devices and reach

Bitdefender said the largest concentrations of infected devices were in Mexico, France and Italy, followed by the United States, Germany, Brazil and Spain. Devices identified in the investigation included the Doogee S200 X and Cubot KINGKONG X, as well as low-cost phones reporting misleading model names such as S24 Ultra, S25 Ultra, S26 Ultra, i17 Pro Max, i16_Pro_Max, 17_Pro_Max, iPadAirPro and Note 18 Ultra.

Android Police reported that genuine Samsung phones were not affected by counterfeit devices using Samsung-style model names. Bitdefender said the affected devices were built on MediaTek platforms and shipped with the malware already in their firmware.

How the malware operates

Bitdefender’s investigation began after its App Anomaly Detection technology flagged a system package named com.android.system.lite. The company found the same malware core under other system-like package names, including com.android.sys.prot, com.android.sys.gmsprot and com.android.sys.bcprot. The packages can use different signing certificates, and Bitdefender said the shared malware core, rather than any one package name, identifies the threat.

The persistent component is platform-signed, runs as the system user and is integrated into the firmware’s system partition. It appears with the label System and a hidden icon, while its native library, libeasy.so, decrypts and drops an obfuscated Java framework into the system process. Bitdefender said the component’s system-level privileges allow it to silently install and remove apps, grant permissions and load code supplied remotely.

The framework contacts command-and-control infrastructure, retrieves configuration and downloads additional DEX plugins. Bitdefender identified plugin functions for advertising fraud, silent installation and removal of partner apps, and silent permission grants. The company also found at least 32 disguised apps in a rotating family, including fake AppLock, weather, file-manager, icon-tool, OCR and audio-editor apps, with payload apps repeatedly installed and removed on some devices.

Bitdefender said the malware can request Accessibility, Notification Access and SMS read/write permissions. It observed Accessibility and Notification Access being repeatedly granted and revoked, but did not observe those permissions being used during its analysis.

Ad fraud and proxy activity

Bitdefender said operators use the campaign for ad and click fraud, collect information about devices and installed apps, and turn infected phones into residential-proxy relay nodes. It said access to botnets for distributed denial-of-service attacks can also be monetized, with larger botnets potentially commanding higher prices.

The system app itself does not register fraudulent ad impressions and clicks. Instead, Bitdefender said dropped cover apps, including weather, app-lock, note and OCR apps, load advertisements through a legitimate advertising software development kit. The malware can place an invisible window over other apps so advertisements register as displayed, show ads in full-screen activities or overlay windows, fabricate clicks and report conversions without user interaction. It can mark the ad surface as secure so it does not appear in screenshots or screen recordings.

Bitdefender also found that the malware can temporarily disable Google Play Store immediately before installing a payload and re-enable it afterward, a behavior the company said is intended to avoid possible detection by Google Play Protect. It identified a mechanism that can set Google Play as the recorded installer for some installed apps.

A disguised AppLock app, com.mobile.applock.en, acts as a TCP back-connect proxy, according to Bitdefender. It registers an infected phone with a remote control server, which can provide targets for the phone to connect to and relay traffic through its internet connection. Bitdefender found that the proxy infrastructure was live and accepting node registrations, but a newly registered node received no relay targets and relayed no traffic during the company’s observation. A second disguised AppLock app, com.mobile.applock.wt, contains an ad-fraud module and can load remote DEX advertising modules.

Related apps and firmware concerns

Bitdefender found 13 apps on Google Play that communicated with the same servers controlling the malware and carried the same ad-fraud code. Those apps did not have the elevated system privileges of the preinstalled packages, but could display ads outside their normal interfaces, including when users were not using them. The apps were associated with at least two developer accounts, fivedev and CPS Developer, and used 13 different signing certificates. Examples included com.message.recovery.prorestore, picturetranslate.extractor.text.lite and com.arabmusic.tap.aghani_tamerhosny.

The system app and payload family share infrastructure, including a command-and-control service disguised as a weather API. Bitdefender listed api.weatherlive.world among the campaign’s infrastructure.

Bitdefender said it could not determine where in the supply chain the malware was integrated. Possible points include an original design manufacturer, firmware integrator, logistics partner or another party in the distribution chain. Some affected firmware used certificates bearing the name Shenzhen Zediel, a Chinese consumer-electronics company, but Bitdefender said that does not establish that the certificate owner was involved in or aware of the deployment. The company also found affected devices without Zediel-signed firmware.

Removal and response

Bitdefender said some manufacturers have released firmware updates that resolved infections. It also documented a Doogee Fire 3 Max owner’s report on the XDA Developers forum that an official firmware update appeared to reintroduce malware after an older firmware version had removed it.

Because the malware resides in the system partition, ordinary Android app uninstallation does not remove the underlying component. Bitdefender said remediation requires firmware-level cleanup or disabling the component through Android Debug Bridge. Android Authority characterized replacing the device as the most viable option for ordinary users, while Android Police recommended buying phones from authorized sellers and choosing original devices. The company’s findings show that affected phones may require a firmware remedy rather than routine app removal.