Reported by 12 outlets
Midnight Mimosa: ad-fraud malware preinstalled in cheap Android phone firmware
Why this score
- Breadth
- 2.00 / 2.0 · 12 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 2.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.57 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 3.7 / 10 = base × recency + community
Desk analysis
Midnight Mimosa is ad-fraud malware preinstalled in the firmware of cheap Android phones. The malware operates at the firmware level, giving it persistence and broad access to the device. Coverage spans security researchers and industry outlets tracking preinstalled mobile malware campaigns. Why it matters: firmware-level malware bypasses user-level removal and undermines trust in low-cost device supply chains. Watch for vendor responses, affected model lists, and any links to broader supply-chain compromise campaigns.
Timeline
-
original reporting
Midnight Mimosa: cheap Android phones ship ad-fraud malware https:// fawkes.rocks/2026/10/08/midnig ht-mimosa-cheap-android-phones-ship-ad-f
fawkes.rocks · 5d ago · October 8th, 2026
Midnight Mimosa: cheap Android phones ship ad-fraud malware https:// fawkes.rocks/2026/10/08/midnig ht-mimosa-cheap-android-phones-ship-ad-f
via Mastodon https://fawkes.rocks/2026/10/08/midnight-mimosa-cheap-android-phones-ship-ad-fraud-malware/
-
original reporting
Midnight Mimosa: Preinstalled Android malware in MediaTek firmware
www.all-about-security.de · 4d ago · October 9th, 2026
Midnight Mimosa: Preinstalled Android malware from the factory. The malware is embedded in the firmware of cheap Android smartphones using MediaTek chipsets. via Mastodon https://www.all-about-security.de/midnight-mimosa-vorinstallierte-android-malware-ab-werk/
-
update from securelist.com
Keenadu the tablet conqueror and the links between major Android botnets
securelist.com · 238d ago · February 17th, 2026
Kaspersky researcher Dmitry Kalinin documented KeenAndu, a firmware-level backdoor linked into libandroid_runtime.so during the build phase and injected into the Zygote process, sometimes delivered through official OTA updates. The research connects the Triada, BADBOX, Vo1d and KeenAndu botnets into one cluster and includes a Nova clicker module from the Phantom lineage that Bitdefender later associates with Midnight Mimosa payloads and the Android.Phantom family.
-
update from bitdefender.com
The phone was compromised before the user turned it on: the rise of Midnight Mimosa
bitdefender.com · 5d ago · October 8th, 2026
Bitdefender's original disclosure by Adrian Mihai Gozob and Alex Baciu documents a platform-signed system application preinstalled in low-cost MediaTek Android firmware, shipping as com.android.system.lite and rotating names including com.android.sys.prot, com.android.sys.gmsprot and com.android.sys.bcprot. The report details at least 32 disguised payload apps, ad and click fraud, residential-proxy enrollment, a C2 disguised as a weather API at api.weatherlive[.]world, certificates linked to Shenzhen Zediel, and thousands of affected devices across over 150 countries over roughly two years.
-
mentioned by hackread.com
Midnight Mimosa malware found preinstalled on low-cost Android phones
hackread.com · 5d ago · October 8th, 2026
-
update from techalarab.com
Your new budget Android phone might be infected with malware straight out of the box before you even turn it on. Cheap Android Phones Found
techalarab.com · 5d ago · October 8th, 2026
Your new budget Android phone might be infected with malware straight out of the box before you even turn it on.
-
update from bleepingcomputer.com
Low-cost Android phones ship with residential proxy malware
bleepingcomputer.com · 5d ago · October 8th, 2026
A malware campaign dubbed 'Midnight Mimosa' has been discovered on low-cost Android smartphones that ship with malicious software embedded in their firmware, allowing attackers to silently install apps, perform ad fraud, and turn devices into residential proxies. The malware is believed to have been introduced somewhere in the device supply chain, but it remains unclear who is responsible for modifying the firmware or at what stage the tampering occurred. The malware is embedded directly into the firmware of low-cost Android devices using MediaTek chipsets, giving it system-level privileges that allow it to install and remove applications, grant sensitive permissions, and execute remotely downloaded code without user interaction. According to Bitdefender researchers , the campaign affected thousands of devices across more than 150 countries over approximately two years, with the highest number of victims in Mexico, France, Italy, United States, Germany, Brazil, and Spain. The researchers found preinstalled malware on devices with model names associated with legitimate manufacturers, including the Doogee S200 X and Cubot KINGKONG X, as well as phones impersonating Samsung and Apple products. In an XDA forums post , owners of Cubot and Doogee smartphones reported finding suspicious applications that repeatedly reinstalled themselves after removal. One Doogee Fire 3 Max owner also reported that an official firmware update infected the device with the malware, which disappeared a
-
mentioned by www.bleepingcomputer.com
🤖 "Midnight Mimosa": low-cost Android phones (MediaTek) ship with malware baked into firmware. Bitdefender found system-signed packages that
www.bleepingcomputer.com · 5d ago · October 8th, 2026
-
update from securityweek.com
Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries
securityweek.com · 4d ago · October 9th, 2026
There is a large global market for low-cost Android devices. Bad actors are aware and are servicing the demand through devices built on MediaTek platforms – but with malware preinstalled in the device firmware. When the recipient of such an affected device switches it on, the malware is present, unseen, and available to any bad actor who can control it remotely from its C2. It is a persistent, pre-installed firmware system app that cannot be removed by normal uninstall procedures. The potential for this type of malware infection controlled via the actor’s C2 is massive. This essentially means its operators could install and delete apps at will, tuning each device to their needs, including making them part of large botnets,” writes the Bitdefender report. Midnight Mimosa is focused on ad fraud, automated click fraud, and turning the device into a single component of a much larger botnet. This makes sense for a campaign seeking to fly under the radar with an army of soldiers. Many thousands of click frauds over a period of time would provide a healthy ROI for any bad actor. And botnets are described as a hot commodity that can be rented out to other bad actors. The bigger the botnet, the better the bounty. Over the last two years, Bitdefend
-
update from en.hacks.gr
Bitdefender researchers have uncovered 'Midnight Mimosa', a firmware-level malware preinstalled on low-cost Android devices built on MediaTe
en.hacks.gr · 1d ago · October 12th, 2026
Bitdefender researchers have uncovered 'Midnight Mimosa', a firmware-level malware preinstalled on low-cost Android devices built on MediaTe
via Mastodon https://en.hacks.gr/kryfo-programma-se-fthina-kinita-android-ta-metatrepei-se-ergaleia-diafimiseon-apo-to-ergostasio/
-
update from gbhackers.com
Android Firmware Malware Uses Ad Fraud and Proxy Botnets to Generate Revenue
gbhackers.com · 1d ago · October 12th, 2026
Unlike malware requiring a malicious download, Midnight Mimosa arrives […] The post Android Firmware Malware Uses Ad Fraud and Proxy Botnets to Generate Revenue appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
mentioned by linuxmint.hu
CW: Pre-installed malware Bitdefender: Midnight Mimosa — thousands of cheap MediaTek-based phones have a system application built into their firmware
linuxmint.hu · 1d ago · October 12th, 2026
-
mentioned by www.bitdefender.com
Bitdefender's Midnight Mimosa: malware in the firmware of cheap MediaTek Android phones. A platform-signed "system" app (com.android.system.
www.bitdefender.com · 1d ago · October 12th, 2026
-
update from www.bitdefender.com
# Bitdefender has identified a # malware campaign "#MidnightMimosa", running on low-cost multi-brand # Android device using # MediaTek SoC.
www.bitdefender.com · 21h ago · October 13th, 2026
Bitdefender has identified a # malware campaign "#MidnightMimosa", running on low-cost multi-brand # Android device using # MediaTek SoC.
-
update from thehackernews.com
🚨💸 Cheap phone? Ugh! Beware some cheap android phones: preinstalled malware is not part of the official price. https:// thehackernews.com/20
thehackernews.com · 20h ago · October 13th, 2026
Ugh! Beware some cheap android phones: preinstalled malware is not part of the official price.