Bitdefender reported on October 8, 2026, that Midnight Mimosa was preinstalled in the firmware of certain low-cost, multi-brand Android devices built on MediaTek platforms. Firmware is the software built into a device; here, the malware was present before the phone’s first power-on. The finding concerns that defined group of devices. Bitdefender’s technical analysis describes a persistent system component with privileges that let it silently install or remove apps, grant permissions and load code supplied remotely.
How the firmware component works
Bitdefender identified com.android.system.lite as a core package, along with related builds whose package names can rotate. A package name alone, then, is not a dependable way to identify the malware.
The component can deploy a rotating family of at least 32 disguised apps, including weather, app-lock, notes, OCR, file-manager and audio-editor tools. Bitdefender also found 13 Google Play apps with related ad-fraud code and communications with the same servers. Those apps did not have the firmware component’s system privileges.
Bitdefender observed hidden ad impressions and clicks, as well as a separate residential-proxy function that relays internet traffic through a device’s connection. It describes revenue generation as the likely primary motive. The component can also disable Google Play Store before installing a payload and turn it back on afterward; Bitdefender says this was probably intended to evade Play Protect.
The system component requested Accessibility, Notification Access and SMS permissions. Bitdefender did not observe those permissions being used during its analysis.
What the US figure counts
The United States accounted for 8.36% of the devices in Bitdefender’s observed Midnight Mimosa dataset. The figure is a share of that dataset, not the proportion of US Android phones infected. Bitdefender reported observing thousands of devices across more than 150 countries over roughly two years.
The dataset also associated Doogee with the S200 X and Cubot with the KINGKONG X among its highest-volume genuine named model entries. These model names describe entries in Bitdefender’s campaign data; the finding is scoped to the devices it examined.
Why a factory reset may not remove it
Bitdefender places the component in the system partition, a protected area that holds core Android software. Removing an app in the usual way is not enough, and a factory reset cannot be relied on to remove this firmware-resident component.
Bitdefender describes firmware-level cleanup or disabling the component through ADB, the Android Debug Bridge used to communicate with a device from a computer. It considers either approach unrealistic for most owners of affected devices.
