Midnight Mimosa: Bitdefender finds malware preinstalled in the firmware of cheap Android phones. How to check yours

On October 8, 2026, Bitdefender Labs published an analysis of Midnight Mimosa, malware that comes preinstalled in the firmware of some low-cost Android phones built on MediaTek platforms. "The phone was compromised before the user turned it on," the researchers write. Because the malware is part of the system image, owners can't uninstall it the normal way. Bitdefender says its main purpose is to make money from ad fraud and from renting out the phone's internet connection. Google, which makes Android and the Gemini assistant, hadn't commented as of October 12, and neither had MediaTek or the phone makers named.

This story is based on Bitdefender's research post (updated October 9), Google's Play Protect help pages and Android's developer documentation, plus coverage by Android Authority, checked October 12, 2026.

The short version

• What: a platform-signed system app that Bitdefender calls the "enabler." It installs and removes apps, grants permissions and loads code from the internet, all silently.
• Where: in the firmware of budget, multi-brand Android phones on MediaTek platforms. It is present before first boot.
• Scale: "thousands of unique devices across more than 150 countries" over roughly two years, led by Mexico, France and Italy.
• Named models: the Doogee S200 X and Cubot KINGKONG X had the most detections. Counterfeit phones sold as "S25 Ultra" and "i17 Pro Max" were also affected.
• What to do: check whether your phone is Play Protect certified, look for the package names below, and if it's infected, plan to replace the phone or install clean firmware from the maker.

What does Midnight Mimosa do?

According to Bitdefender, the core component is a system app first identified as com.android.system.lite. Because it is signed with the firmware's platform key, it has system-level powers. Bitdefender says it uses them to:

• silently install at least 32 disguised apps, such as fake app lockers, weather apps and OCR tools, and grant them permissions without asking you;
• generate ad and click fraud: fake ad impressions and invisible "clicks";
• turn the phone into a residential-proxy node that relays other people's internet traffic;
• disable the Play Store before installing a payload, which takes Google Play Protect's scanner out of the picture, and turn it back on afterwards;
• label some of the apps it installs as coming from the Play Store (com.android.vending), even though they don't carry Google's Play signature.

The enabler also holds Accessibility, Notification Access and SMS permissions. Bitdefender says it did not see the Accessibility or Notification Access permissions being used. Its command server runs on the domain api.weatherlive[.]world.

Bitdefender links the operator to earlier Android malware families that the antivirus company Dr.Web tracked from 2021 onward. It also found the same ad-fraud code in 13 apps on Google Play, which it describes as genuine Play builds that passed Google's review.

Which phones are affected?

Bitdefender doesn't publish a complete list of models. What it does name:

• Doogee S200 X and Cubot KINGKONG X, the two models with the highest detection counts. Bitdefender notes that an XDA forum user had already reported a similar hidden package on a Cubot phone.
• White-label builds with model codes such as J10_EEA and A9_EEA, and a MediaTek MT6762 board (k62v1_64_bsp).
• Counterfeit "flagships" sold under names such as "S25 Ultra" and "i17 Pro Max."

Much of the affected firmware was signed with certificates attributed to Shenzhen Zediel Co., Ltd. Bitdefender stresses that this "does not constitute proof" that the company wrote the malware or knew about it, and that the malware also appears on devices from other sources. Who inserted it into the supply chain, whether an original design manufacturer, a firmware integrator or someone else, is beyond its analysis. Android Authority notes that many low-cost phones are not affected. Owning a Doogee or Cubot phone doesn't mean yours is infected.

How do I check my phone?

1. Check Play Protect certification. Google's help page explains how: open the Play Store, tap your profile icon, then Settings › About, and look at "Play Protect certification." Google says devices that aren't certified "may not be secure" and may not get system or app updates. A certified phone isn't automatically clean, but an uncertified one, especially a "flagship" sold far below the real price, is a warning sign.

2. Look for the enabler's package names. Bitdefender lists com.android.system.lite, com.android.sys.prot, com.android.sys.gmsprot and com.android.sys.bcprot as names for the same core. It also counts com.android.weiapps, com.android.sys.dts and com.android.non.szcz as builds of the enabler family. The Settings app usually shows app names, not package names, so the reliable way to check is from a computer with Android's adb tool. Turn on USB debugging, connect the phone, and run:

adb shell pm list packages | grep -E "com.android.system.lite|com.android.sys.|com.android.weiapps|com.android.non.szcz"

pm list packages is the standard Android package-manager command documented in Google's adb reference. Bitdefender warns that "the package name is not the threat. The shared core underneath it is," so a clean result doesn't rule out a renamed variant.

3. Look for symptoms. Unfamiliar apps you didn't install (fake lockers, weather or scanner apps), a Play Store that sometimes appears disabled, or unexplained mobile data use can all point to an infection.

What can I do if my phone is infected?

Not much on the phone itself. Bitdefender says removal requires a firmware-level cleanup or disabling the component over ADB, which and that "neither is realistic for most people who own these phones"; the "durable fix" sits with the vendors and marketplaces that ship and sell the firmware. Android Authority concludes that replacing the device is the most practical option.

In the meantime:

• don't use the phone for banking, work accounts or two-factor codes;
• sign out of important accounts on it, then change those passwords from a clean device;
• ask the seller or maker whether clean firmware is available, and ask for a refund if it isn't;
• next time, buy phones that are Play Protect certified from established brands and retailers. Google's warning about uncertified devices applies.

What's confirmed, reported and uncertain

• Confirmed (Bitdefender): the malware's behavior, package names, command domain, the more than 150 countries, the top countries, and the named model strings.
• Reported: Android Authority's coverage repeats Bitdefender's findings and adds the advice to replace affected phones.
• Unknown:
  • the exact number of infected phones ("thousands")
  • which firmware versions are affected
  • who inserted the malware
  • whether Doogee, Cubot, MediaTek or Google have responded
  • whether Bitdefender notified them before publishing (its post doesn't say)

Why this matters beyond cheap phones

Supply-chain compromises like this break the usual advice to "only install apps from the Play Store." The malware was there before the owner installed anything. The same lesson runs through other security stories from the same week: equipment you never chose to distrust can be the weak point. Self-hosted AI servers left open to the internet were hijacked by the PoeLLM botnet, outdated refrigeration controllers were turned against French supermarkets, and the UK government stepped up its AI security push.