Midnight Mimosa: budget Android phones ship with uninstallable malware
Midnight Mimosa preinstalled Android firmware malware

Midnight Mimosa: budget Android phones ship with uninstallable malware

Bitdefender has documented a campaign it calls Midnight Mimosa. The malware is already in the firmware when the buyer powers the phone on. It cannot be uninstalled. The point is money: ad fraud, click fraud, and residential-proxy capacity.

What happened

The scheme shows up on budget Android devices from several brands, built on MediaTek chipsets. A preinstalled app, com.android.system.lite, labelled System, has no icon and does not appear in the launcher. It runs as the system user. From there it can silently install and remove apps, grant itself Accessibility, Notification Access, and SMS rights, and load code from a command-and-control server.

Bitdefender says the operators install a rotating set of at least 32 cover apps, weather tools, app locks, file managers, and similar, then show ads the owner never requested, including taps registered with no touch. The same ad-fraud code appeared in 13 Google Play apps under at least two developer accounts. Just before installing a payload, the malware disables the Play Store app, which hosts Play Protect's on-device scanner, then turns it back on.

The campaign was seen on thousands of unique devices in more than 150 countries. Mexico, France, and Italy lead, followed by the United States, Germany, Brazil, and Spain. Many affected models are counterfeits using flagship-style names such as i17 Pro Max, S25 Ultra, and Note 18 Ultra. The two most common genuine-brand models in the infected set are the Doogee S200 X and the Cubot KingKong X. Owners on XDA had already reported apps that reinstalled themselves after removal.

Who is affected

Anyone who bought a cheap Android from an online marketplace, and any business that hands those phones to staff, field techs, or visitors. A device in this state can read the screen, see what is typed, read notifications, and pull one-time SMS codes if the operator asks for it. Bitdefender did not observe that abuse during analysis. The permissions are there. Because the component lives in the system partition, a factory reset does not remove it. Cleanup needs a firmware reflash or an ADB disable, which is not realistic for most owners.

  • Marketplace phones and counterfeit flagship-named devices.
  • Doogee S200 X and Cubot KingKong X were the most common named models.
  • Staff, guest, and field phones that join corporate Wi-Fi or email.

What to do now

Do not issue marketplace budget Androids to staff. If one is already on the network, remove it from corporate Wi-Fi, email, and VPN until the model is confirmed clean. Check for com.android.system.lite and the related package names com.android.sys.prot, com.android.sys.gmsprot, and com.android.sys.bcprot. Buy phones from authorised channels, and do not treat a counterfeit flagship name on a listing as a Samsung or Apple device.

Source: Help Net Security, Low-cost Android phones are arriving with malware that owners cannot uninstall. Bitdefender write-up: Midnight Mimosa.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

Danfoss refrigeration controllers hijacked at French supermarkets
Danfoss AK-SM refrigeration controller store freezer attack