Pre-installed Android malware evades uninstallation on budget phones
Bitdefender reports firmware-level malware on cheap Android devices that cannot be removed by users, affecting thousands of phones globally.
Key points
- The Midnight Mimosa campaign targets budget Android phones built on MediaTek platforms.
- The malware is embedded in device firmware before the first power-on and cannot be uninstalled.
- Bitdefender observed the campaign on thousands of devices across more than 150 countries.
Organizations managing mobile device fleets face a new supply-chain risk with the discovery of firmware-level malware on low-cost Android phones. Bitdefender identified a campaign called Midnight Mimosa, which installs malicious code into the device operating system before the owner ever powers on the phone. This pre-installed nature means standard uninstallation methods fail, leaving the compromise persistent and difficult to detect through normal user actions.
How it unfolded
- Bitdefender’s App Anomaly Detection flagged a component named com.android.system.lite for behaving unlike a standard system process.
- The component repeatedly enabled Accessibility and Notification Access permissions while silently installing and removing unrelated applications.
- Investigators found that the malware, dubbed Midnight Mimosa, was present in the device firmware prior to the first boot sequence.
Who is affected
According to Bitdefender, the campaign affects budget Android devices from various brands that utilize MediaTek hardware platforms. The investigation identified thousands of unique infected devices spread across more than 150 countries. Mexico, France, and Italy showed the highest concentration of affected devices, followed by the United States, Germany, Brazil, and Spain. The malware runs with system-level privileges, allowing operators to silently install or remove apps, grant permissions, and load arbitrary remote code.
Many of the affected devices are counterfeits that mimic flagship models. Model strings found on infected units include “i17 Pro Max,” “S25 Ultra,” “S24 Ultra,” and “Note 18 Ultra.” Some devices not manufactured by Samsung report the Galaxy S25 Ultra model code SM-S938B. The two most common models among the infected group are the Doogee S200 X and the Cubot KINGKONG X. Users of Cubot and Doogee phones previously reported on the XDA forum that suspicious apps would reinstall themselves after deletion.
Bitdefender states the scheme is likely designed to generate revenue through ad fraud, click fraud, and data collection. The malware turns infected devices into residential-proxy relay nodes, effectively creating zombies for botnets. Access to these botnets for DDoS attacks is a commodity, and larger botnets allow operators to charge more. One specific app, com.mobile.applock.wt, posed as an app lock but lacked a code and remained hidden from the user.
Our take on the response
The integration of malware into the firmware before the first boot suggests a compromise in the manufacturing or distribution supply chain rather than a post-purchase infection. Because the malicious component holds system-level privileges, it can bypass standard user controls and persist even after attempts to remove associated apps. This indicates that the threat originates from the device itself, making traditional endpoint protection on the phone less effective against the core compromise.
What to do and how to stay safe: Bitdefender
- Inspect device model strings and manufacturer details for inconsistencies, such as non-OEM brands reporting flagship model codes.
- Monitor for system components that repeatedly enable Accessibility or Notification Access permissions without user interaction.
- Watch for applications that reinstall themselves automatically after being removed from the device interface.
- Verify the source of low-cost Android devices, as online marketplaces may sell units with pre-loaded malicious firmware.
Step-by-step guide: Social Engineering Tactics: How Attackers Bypass Technical Defenses
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Can users remove the Midnight Mimosa malware from their phones?
No, Bitdefender reports that the malware is embedded in the device firmware and cannot be uninstalled by the owner.
Which phone models are most commonly affected by this campaign?
The Doogee S200 X and Cubot KINGKONG X are the two most common models among infected devices.
What does the malware do once it is active?
It runs with system-level privileges to install/remove apps, collect data, and turn devices into botnet nodes for ad and click fraud.
