Bitdefender researchers have uncovered a malware campaign, dubbed Midnight Mimosa, affecting low-cost Android phones sold through online marketplaces. The malicious code is embedded in the device firmware, meaning it is active before the owner first switches on the phone and cannot be removed through normal means. The malware runs with system-level privileges, allowing operators to silently install or delete apps, grant permissions, and load arbitrary code from a remote server.
The campaign appears to be financially motivated. Infected devices are used for ad and click fraud, collection of device and installed-app information, and as residential-proxy relay nodes in botnets. Bitdefender observed thousands of unique devices across more than 150 countries, with Mexico, France, and Italy leading. Many affected models are counterfeits borrowing flagship names, while the most common legitimate models are the Doogee S200 X and Cubot KINGKONG X.
The main malicious component disguises itself as a system app labeled "System" and communicates with a command-and-control server. It requests Accessibility, Notification Access, and SMS permissions, which could be used to read screens, intercept chat messages, and send premium-rate texts. The same ad-fraud code also appeared in 13 apps on Google Play, which passed review and were published under developer accounts fivedev and CPS Developer, though they lack the system-level access of the preinstalled version.