-
Bitdefender found hidden malware built into the firmware of low-cost Android phones, before buyers even turn them on.
-
The hidden program can secretly install apps, show fake ads, and turn phones into relay points for hackers.
-
Researchers found infected devices in over 150 countries, but no one knows who placed the malware there.
Thousands of cheap Android phones may have shipped with secret malware already inside them. In its recent research, known cybersecurity firm Bitdefender uncovered the campaign and named it Midnight Mimosa. The hidden program sits inside the phone’s built-in software, called firmware.
This means the malware can run before the owner even switches the phone on for the first time. Bitdefender shared its findings on October 8, 2026, and outlets such as The Record, BleepingComputer, and SecurityWeek also reported the story.
Most malware needs a user to click a bad link or download a fake app first. Midnight Mimosa skips that step entirely. It lives deep inside the phone’s system software. That gives it power to install apps, remove apps, and grant permissions on its own. The owner never needs to approve any of it. Deleting apps the normal way will not remove this hidden program either.
How the Hidden Program Sneaks Onto Phones
Bitdefender found several versions of the malicious system app. One version uses the name com.android.system.lite. The app copies the look of a real Android system file. It hides itself with no visible icon on the home screen. It also runs with the highest level of system access a phone allows.
According to Bitdefender, the hidden program reaches out to remote servers for more harmful code. It then quietly installs other apps without asking the user. These extra apps often pretend to be useful tools. Some pose as app lockers. Others pretend to be weather apps or file managers. A regular user would have no reason to suspect them.
The campaign mainly targets budget phone brands built on MediaTek chips. Bitdefender named Doogee’s S200 X and Cubot’s KINGKONG X as two of the clearest examples. Some counterfeit phones in the investigation also copy the names of flagship brands, including Samsung Galaxy models. This does not mean real Samsung or Apple phones carry the malware. The fake phones simply borrow famous names to look more trustworthy to buyers.
Bitdefender also found 13 separate apps on the Google Play Store. These apps talked to the same servers used by the Midnight Mimosa operation. They share some of the same ad-fraud code as the firmware malware. However, these Play Store apps do not have the same deep system access. Their presence does not mean the whole Google Play Store, or all of Android, is unsafe.
What the Malware Actually Does to a Phone
Bitdefender explained that Midnight Mimosa mainly earns money through advertising fraud. The hidden apps load real ads in the background, but they hide this activity from the phone’s owner.
Malware can also threaten digital assets through other attack methods, as seen when hackers stole $38 million in bitcoin from over 500 Coldcard Mk3 Wallets. This lets the people behind the scheme fake ad clicks and views. Advertisers end up paying for traffic that never came from a real, interested person.
The malware can also turn an infected phone into something called a residential proxy. This lets outside parties route their own internet traffic through someone else’s phone. Doing this can hide where that traffic truly comes from. Bitdefender warned that infected phones could also become part of a larger botnet. Attackers sometimes use botnets to flood websites with traffic and knock them offline, an attack known as a DDoS attack.
BleepingComputer and The Record reported that the campaign has likely run for close to two years. It appears to have reached devices in more than 150 countries during that time. However, the current findings do not prove that every single infected phone has taken part in a DDoS attack.
No One Knows Who Built This Into the Phones
Bitdefender has not identified who placed Midnight Mimosa inside the firmware. The malware could have entered the supply chain through a phone maker, a firmware builder, a shipping partner, or some other middleman along the way. Researchers did spot certificates bearing the name Shenzhen Zediel on some infected firmware. That detail alone does not prove the company knowingly added the malware itself.
Because the hidden program sits in the system partition, removing it is not simple. Bitdefender said a real fix may require cleaning the firmware directly. Some users might need a tool called Android Debug Bridge, or ADB, to disable the hidden component. Many ordinary phone owners would likely find this process too technical to attempt alone.
Buyers can lower their risk by choosing trusted sellers and checking that a phone’s model name matches its real specs. Installing official firmware updates when they become available also helps. Still, none of these steps can guarantee a phone is clean if the malware was already baked in before the sale.
This case shows how a phone can be compromised before its new owner installs a single app. For already-affected phones, a true fix depends on finding and removing the hidden code from the firmware itself. Until manufacturers and sellers strengthen supply-chain checks, cheap phones may keep carrying risks that no setting or app can fully solve.
