Midnight Mimosa: The Malware Living in Firmware Before You Even Power On

Bitdefender's technical report from October 8, 2026 documents a pre-installed malware campaign dubbed Midnight Mimosa targeting low-cost Android devices sold on online marketplaces. The phone is compromised at the firmware level before the user powers it on for the first time. With system privileges guaranteed by the platform signature, the malware cannot be removed by a factory reset or ordinary uninstall tools.

The Platform Signature: A Privilege That Evades Every User-Centric Defense

The technical core of the threat lies in the platform certificate signature. On Android, apps signed with the platform certificate share the same trust level as the operating system itself. This means Midnight Mimosa requires no post-purchase exploit: it resides in the system partition, receives OTA (Over-The-Air) updates controlled by the operators, and survives every reset.

According to the Bitdefender report, the malware "runs as the system user" with the ability to silently install and remove apps, grant permissions, and load arbitrary code remotely. The primary source explicitly emphasizes that "every user-facing defense had already been bypassed by the time the phone was switched on".

Evasion Mechanisms: Play Protect Disabled and Install Source Spoofed

Midnight Mimosa demonstrates deep knowledge of Android security controls. Before every payload installation, the malware temporarily disables the Google Play Store app (com.android.vending), then re-enables it immediately after. This sequence, documented by both Bitdefender and SecurityWeek, nullifies Play Protect detection for the duration of the operation.

The mechanism is completed by spoofing the installation origin: some payloads register Google Play as the source despite lacking the server-side 'frosting' signature Google uses to authenticate genuine installations. The combination creates forged evidence that makes forensic traceback difficult.

Ad Fraud and Proxyware: The Dual Face of Monetization

The campaign does not stop at persistence. Bitdefender identified at least 32 'cover' apps that load legitimate ad SDKs generating windows with the secure flag — uncapturable by screenshots — producing synthetic clicks invisible to the user. In parallel, the payload com.mobile.applock.en functions as a TCP proxy on port 6000, enrolling devices into a residential network for botnet activity.

Security Affairs and Hackread confirm that proxy traffic rotates across four different domains, making DNS blocking insufficient as a sole countermeasure. The primary source does not quantify the revenue generated, but the hybrid structure — ad fraud plus proxyware — indicates an industrial-scale operation.

Affected Models: Between Counterfeit Flagships and the MediaTek Supply Chain

The devices most frequently observed by Bitdefender are the Doogee S200 X and the Cubot KINGKONG X. Alongside these, however, terminals with counterfeit flagship names also emerge: i17 Pro Max, S25 Ultra, S24 Ultra, Note 18 Ultra. Android Police clarifies that Samsung and Apple are not involved: the names are reused by unauthorized manufacturers to attract buyers on marketplaces.

On some devices, a platform signing certificate associated with Shenzhen Zediel Co., Ltd. was detected. Bitdefender warns, however, that this data "does not prove the company wrote or distributed the malware". The exact point of insertion in the supply chain — ODM, firmware integrator, logistics partner — remains unknown.

"The phone was compromised before the user turned it on: the rise of Midnight Mimosa"

13 Apps on Google Play and the Certificate Chain

A particularly disturbing element concerns the secondary distribution corridor. Bitdefender identified 13 apps on the Google Play Store sharing the same ad-fraud code as Midnight Mimosa. These apps are signed with 13 different certificates, distributed through two developer accounts: 'fivedev' and 'CPS Developer'.

The multiplicity of certificates raises questions about the operational structure: whether it is a single actor fragmenting their footprint, or an affiliate network with shared access to the codebase. The dossier does not resolve this point.

What to Do Now

Bitdefender explicitly recommends device replacement or vendor intervention for confirmed infected models. Removal requires firmware flashing or ADB access with elevated privileges — procedures unrealistic for the average consumer.

For those who purchased Doogee S200 X, Cubot KINGKONG X, or models with counterfeit names i17 Pro Max, S25 Ultra, S24 Ultra, Note 18 Ultra on online marketplaces, verification relies on these indicators: presence of the packages com.android.system.lite or com.android.sys.prot in system apps; DNS connections to api.weatherlive.world; outbound TCP traffic on port 6000. None of these indicators is removable without firmware access.

For users unable to technically verify their device, the report's specific recommendation is to avoid purchasing low-cost phones from unauthorized vendors using counterfeit flagship names. The discounted price does not offset the irreversible system-level compromise.

Why This Matters

The Bitdefender report documents no specific corrective measures a user can apply independently. Removal requires firmware-level intervention or ADB, procedures unrealistic for the average consumer. The cited source explicitly recommends device replacement or vendor intervention.

The dossier does not specify whether the Accessibility, Notification Access, and SMS permissions granted to the malware were actually used in production beyond being assigned. Bitdefender reports not observing active use of these permissions during analysis, but their presence in the manifest indicates potential capability.

Also unknown are the complete list of affected models and the exact extent of the active proxyware network. No infrastructure overlaps link the Midnight Mimosa operators to known threat actors at this time.

FAQ

Can a standard antivirus detect Midnight Mimosa?

No. If the malware is active with system privileges, it can disable or evade runtime checks. The platform signature places it outside the user-centric security perimeter.

Does a factory reset eliminate the threat?

No. The malware resides in the system partition, which a factory reset does not touch. Removal requires firmware flashing or ADB access with elevated privileges.

Are all affected devices Chinese?

The identified models are produced by Chinese ODMs, but distribution is global: over 150 countries with concentration in Mexico, France, and Italy. Sales occur primarily through online marketplaces.

Information is based on the cited source and current as of publication.

Sources

• https://www.helpnetsecurity.com/2026/10/12/midnight-mimosa-malware-cheap-android-phones/
• https://www.securityweek.com/pre-baked-firmware-malware-hits-budget-android-devices-in-150-countries/
• https://hackread.com/midnight-mimosa-malware-preinstalled-android-phones/
• https://securityaffairs.com/200759/malware/bitdefender-finds-preinstalled-android-malware-you-cant-uninstall-seen-in-150-countries.html
• https://www.androidpolice.com/this-android-malware-can-reach-your-phone-before-you-ever-use-it/
• https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware
• https://www.helpnetsecurity.com/2025/09/30/low-cost-android-devices-security-risks/
• https://podcast.securityweek.com/