Preinstalled malware discovered on cheap Android phones across dozens of countries
Bitdefender researchers have identified a firmware-level malware campaign, dubbed Midnight Mimosa, that ships on low-cost Android devices before users power them on.
Bitdefender’s analysis uncovered a sophisticated Android malware family called Midnight Mimosa that is preinstalled on budget smartphones built on MediaTek chipsets. By residing in the firmware’s system partition, the code can silently install and uninstall apps, access sensitive data and download additional malicious components, even disabling Google Play temporarily to evade Play Protect. The campaign has affected thousands of devices in over 150 countries, with the greatest concentrations in Mexico, France and Italy, and spread to the United States, Germany, Brazil and Spain.
Infected models include Doogee S200 X and Cubot KINGKONG X, though counterfeit labeling makes identification difficult. The malware primarily drives advertising fraud and can convert phones into residential proxy nodes, though active traffic routing has not been observed. Related rogue applications once listed on Google Play have since disappeared, and removal of the firmware-level infection often requires specialized tools or a clean firmware flash.
Why it matters
Preinstalled malware on cheap phones puts users' data and finances at risk even before they install any apps.
In this story
