Bitdefender detects preinstalled malware on low-cost Android phones in 150 countries

Bitdefender has identified a malicious software campaign preinstalled on the system partition of low-cost Android phones with MediaTek processors, dubbed Midnight Mimosa. The cybersecurity firm confirmed that the code resides in the device firmware before the initial power-on, which prevents uninstallation via standard operating system menus.

The operation has affected thousands of devices in more than 150 countries over approximately two years, with the highest volume of detections in Mexico, France, and Italy, followed by the United States, Germany, Brazil, and Spain. Attackers use budget handsets, unbranded clones, and counterfeit models to monetize illegitimate access.

Persistence mechanism and defense evasion

The main component of the attack disguises itself under system package names such as com.android.system.lite or com.android.sys.prot. Using a native library called libeasy.so, the software decrypts a framework that downloads instructions from a command server disguised as a weather data programming interface.

By holding system privileges, the executable grants and revokes advanced permissions for accessibility, notification reading, and SMS management without user intervention. To bypass Google Play Protect checks when installing secondary tools, the malware temporarily disables the official Google Play Store app and falsifies the installation source record, skipping the server-side cryptographic verification block known as frosting.

Ad fraud and conversion into relay nodes

Bitdefender's investigation documents the silent download of at least 32 cover applications, including app lockers, optical character readers, and weather tools. These programs load valid ads through legitimate development libraries while projecting invisible layers marked as secure to avoid detection in screenshots, executing simulated taps with programmed limits to mimic human traffic.

One of the installed modules, com.mobile.applock.en, lacks a visual interface and functions as a network proxy using the TCP protocol via port 6000. This component channels third-party traffic through the device's home connection toward four rotating domains, integrating the phones into a zombie network aimed at selling residential bandwidth or executing coordinated denial-of-service attacks.

Supply chain and firmware origin

The compromised devices largely correspond to budget manufacturers such as Doogee, in its S200 X model, and Cubot, with the KINGKONG X, along with imitations deceptively labeled as high-end models. Much of the analyzed firmware includes digital signatures associated with the entity Shenzhen Zediel, although Bitdefender notes it could not determine if that company actively participated in the tampering or if its credentials were compromised.

The firm also linked the control infrastructure to historical campaigns described by Dr.Web, such as the Android.Joker family in 2021 and the Android.Phantom and Click variants recorded in 2025. In addition to the factory distribution channel, researchers detected thirteen applications on the Google Play store connected to the same control servers under two different developer accounts.

Remediation requires closely following verification policies in international e-commerce markets and firmware image updates issued by hardware integrators, as eradicating the malicious software requires the use of advanced commands via the ADB console or a full flash of the phone's memory.