Cheap Android Phones in 150 Countries Ship With Malware Baked Into Firmware That Owners Cannot Uninstall

Some cheap Android phones are infected before their owners ever switch them on. Bitdefender has uncovered malware it calls Midnight Mimosa sitting in the firmware of low-cost handsets from several brands built on MediaTek chips, and it cannot be removed by uninstalling anything.

The root component lives in the system partition. Getting rid of it takes a firmware-level cleanup or disabling it over ADB, which is unrealistic for most people who bought a bargain phone. Over roughly two years, Bitdefender counted thousands of unique infected devices in more than 150 countries, led by Mexico, France and Italy, followed by the US, Germany, Brazil and Spain.

Bitdefender put the problem bluntly: "Preinstalled malware is a different threat class. Every user-facing defense assumes the owner is in the loop at installation." Here the owner never is.

A phone that works for someone else

Midnight Mimosa runs with system-level privileges. It can install and remove apps, grant permissions and silently pull code from a remote server. Its goals are mainly financial: ad and click fraud, harvesting information about the device and its apps, and turning phones into relay nodes for a residential proxy network.

That last part has real value. Bitdefender noted that botnet access for DDoS "is a hot commodity," and the bigger the botnet, the more its operators can charge.

The ad fraud is careful work. The malware quietly installs at least 32 cover apps, such as app lockers, weather apps, file managers, OCR tools and audio editors. They load genuine ads through a legitimate ad SDK while an invisible overlay registers impressions, so the ad network credits the cover app. Full-screen ads are flagged as secure so they never show up in screenshots, and synthetic clicks come with daily caps to look organic.

It also covers its tracks against Google. Before dropping payloads, it disables the Play Store, apparently to dodge Play Protect, then switches it back on. It can even fake Google Play as the install source.

How Bitdefender caught it

Researchers spotted the malware by its behavior. A package called com.android.system.lite, with no icon and the label "System," kept enabling Accessibility and Notification Access and silently adding and removing apps. The same core code turned up as com.android.sys.prot, com.android.sys.gmsprot and com.android.sys.bcprot, each signed with a different certificate, so blocking package names alone does not work. Bitdefender did not observe the notification or SMS permissions being used.

Under the hood, a native library named libeasy.so decrypts a hidden framework that fetches its configuration from a command server disguised as a weather API. Payloads are dressed up too, with JAR files named .o and APKs served as .png images. One payload, com.mobile.applock.en, is a pure TCP proxy that enrolls the phone as a relay node over raw TCP port 6000 and rotates through four domains.

The operation reaches beyond the firmware. Thirteen apps on Google Play talk to the same servers, spread across at least two developer accounts and thirteen signing certificates, and all passed Play review. Shared domains also tie the infrastructure to Dr.Web's Android.Joker family from 2021 and its Android.Phantom and Click families from 2025.

Flagships that don't exist

Many of the affected handsets are counterfeits with flagship-sounding names that no real manufacturer sells, such as "i17 Pro Max," "S25 Ultra" and "Note 18 Ultra." The two most common affected models are the Doogee S200 X and the Cubot KINGKONG X. On the XDA forums, users had already found a hidden com.android.sys.* package that came back under a new name after they removed it.

Who put it there is still an open question. Many infected phones run firmware signed with certificates linked to Shenzhen Zediel, but Bitdefender could not establish how the malware got onto them or whether the certificate owner knew. Other infected phones lack the Zediel signature, which means a manufacturer, firmware integrator, logistics partner or another link in the supply chain could have added it.

Cheap phones are not the only hardware getting tampered with before the buyer opens the box. Ledger recently found a spy implant inside a wallet sold by its own reseller. Bitdefender's view is that owners cannot fix this themselves. The durable fix sits with vendors and the marketplaces that sell their phones.

Some offers on this page may be paid placements or contain affiliate links.