Pull to refresh
Logo
What Changed
Following Why Sign Up
Low-cost Android phones ship with firmware malware that enables ad fraud and proxy abuse

Low-cost Android phones ship with firmware malware that enables ad fraud and proxy abuse

New Capabilities

Bitdefender's 'Midnight Mimosa' ran about two years across 150 countries; the linked Play Store apps are now gone

October 8th, 2026: Bitdefender publishes Midnight Mimosa findings

Overview

Updated Oct 25

Some low-cost Android phones arrive with malware already in the firmware. Bitdefender named the campaign Midnight Mimosa after finding it on phones built on MediaTek chips, where it installs and removes apps and pulls new modules from a remote server.

The malware also turns each phone into a residential proxy, relaying other people's traffic through the owner's connection. Bitdefender watched it run for about two years across more than 150 countries before publishing on October 8. Since then the 13 Play Store apps that carried the same ad-fraud code have been taken off the store.

Why it matters

A cheap Android phone can arrive already compromised, quietly earning attackers ad-fraud revenue and routing their traffic through your home connection.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

150+
Countries with infected devices
Highest victim counts in Mexico, France, Italy, the US, Germany, Brazil, and Spain.
~2 years
Campaign observation window
Bitdefender observed infections across roughly a two-year span.
32
Disguised payload apps deployed
Fake app lockers, weather tools, file managers, OCR tools and audio editors.
13
Google Play apps sharing campaign code
Apps under at least two developer accounts; researchers say they have since been taken off the store.
1
Device maker named in firmware certificates
Shenzhen Zediel; Bitdefender says the certificates do not show it wrote or knowingly shipped the malware.
32
Disguised payload apps deployed
Fake AppLock, weather, file-manager, icon-tool, OCR, and audio-editor apps.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

Organizations Involved

Bitdefender
Bitdefender
Security research firm
Published the Midnight Mimosa analysis

The security firm that identified and documented the Midnight Mimosa campaign.
Doogee
Doogee
Phone manufacturer
Affected device brand

Budget Android phone brand.
Cubot
Cubot
Phone manufacturer
Affected device brand

Budget Android phone maker.
MediaTek
MediaTek
Chipset manufacturer
Platform for affected devices

Chipset maker whose platforms power most of the infected low-cost devices.
Google
Google
Technology company
The 13 apps linked to the campaign are no longer on the Play Store, according to Bitdefender

Operator of Android and the Google Play Store, where 13 apps linked to the campaign were listed until they were taken down.
SZ
Shenzhen Zediel
Device and hardware developer
Certificates bearing its name signed some affected firmware

Chinese company that develops and sells smart hardware and consumer electronics; certificates in its name signed some firmware carrying the malware.

Timeline

3 events Latest: October 8th, 2026 · 1 month ago

  1. Bitdefender publishes Midnight Mimosa findings

    Latest Research disclosure

    Researchers document preinstalled firmware malware on low-cost Android phones across 150+ countries, including a proxy component that registers devices with a remote server.

  2. Linked Play Store apps taken off the store

    Platform action

    The 13 Google Play apps that carried Midnight Mimosa's ad-fraud code are no longer listed, Bitdefender researchers said. The apps offered real functions, such as weather forecasts and QR scanning, while showing ads outside the app.

  3. Proxy controller identified as a sinkhole

    Correction

    Bitdefender said one controller address its tests reached, 85.17.70.38, was a sinkhole rather than a live relay. The researchers still have not observed traffic being forwarded through an infected phone.

Scenarios

1

Supply chain source identified, vendors ship firmware fix

Unlikely Resolves by Q2 2027

Discussed by: Bitdefender researchers, who note the injection point could be an ODM, firmware integrator, or logistics partner

Bitdefender or another researcher traces the malware to a specific party in the manufacturing or distribution chain. Affected brands like Doogee and Cubot issue firmware updates that remove the system app, and marketplaces pull the infected devices from sale.

2

Google removes 13 linked Play Store apps

Possible Resolves by Jan 31, 2027

Discussed by: Bitdefender, which flagged the apps as dangerous despite limited privileges

Google reviews the flagged apps, finds they share command-and-control infrastructure with Midnight Mimosa, and removes them from the Play Store. The firmware malware remains on already-sold devices, but attackers lose a legitimate distribution channel for payload apps.

3

Campaign continues largely unaddressed

Likely Resolves by End of 2027

Discussed by: Bitdefender, noting remediation is unrealistic for most owners and fixes sit with vendors

No vendor acts, the malware stays on sold devices, and the operators keep installing and removing payloads to evade detection. The campaign expands to additional low-cost models as supply chain participants fail to change practices.

4

No regulator or vendor pursues the supply chain party behind infected firmware

Likely Resolves by Apr 30, 2027

Discussed by: Bitdefender, which said certificates bearing Shenzhen Zediel's name do not establish that the company created or knowingly distributed the malware

Bitdefender traced some infected firmware to signing certificates in the name of Shenzhen Zediel, an Android device developer, but stopped short of blaming the company and said it could not tell where in the manufacturing chain the malware entered. If no regulator, marketplace or phone brand opens an action against Zediel or another named party, the phones stay infected and the injection point stays unidentified.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

Late 2023

BadBox (2023-2024)

Researchers at Human Security found malware preinstalled on cheap Android TV boxes and phones sold through online marketplaces. The malware ran ad fraud and turned devices into residential proxies for relaying malicious traffic.

Then

Google disrupted the operation in part by cutting off communication channels, and some distribution networks were shut down.

Now

Established the pattern of budget Android hardware being compromised somewhere in the supply chain for ad fraud and proxy abuse.

Why this matters now

Midnight Mimosa follows the same playbook: firmware-level compromise of low-cost devices, monetized through ad fraud and residential proxy relay.

2016-2017

Triada (2016-2017)

Security firm Dr. Web found the Triada trojan embedded in the firmware of budget Android phones. The malware rooted devices, intercepted messages, and ran ad fraud with system-level privileges.

Then

The infection was traced to firmware distributed to multiple cheap phone brands, and Google tightened Play Protect enforcement.

Now

Became one of the first widely documented cases of Android malware arriving preinstalled, showing that system partition access is the most durable infection.

Why this matters now

Triada demonstrated that firmware-level malware on budget devices is neither new nor easily removed; Midnight Mimosa shows the model has matured to include proxy botnets.

Sources

(11)
+5
BleepingComputer Bitdefender Labs Android Authority The Record Yahoo Tech Trusence SecurityWeek The Hacker News BGR Cybersecurity News Reput.io