Security researchers from Bitdefender identified a malware campaign dubbed Midnight Mimosa affecting budget smartphones. The malicious software is pre-installed at the factory level, appearing in the device firmware before the user even powers on the phone for the first time.
The malware targets low-cost devices, including clones of flagship models like S24 Ultra, S25 Ultra, S26 Ultra, i17 Pro Max, i16 Pro Max, and 17 Pro Max. Additionally, the infection has been detected on specific models from established manufacturers, namely the Doogee S200 X and Cubot Kingkong X.
Operating with system-level privileges, Midnight Mimosa can install or remove applications, grant permissions, and download code remotely. To avoid detection by Google Play Protect, the malware disables the Google Play Store before executing its primary malicious payload.
The campaign aims to generate profit through hidden advertising, click fraud, and by utilizing infected devices as proxy nodes for DDoS attacks. Over the past two years, the malware has been identified on several thousand devices across more than 150 countries.
The highest concentrations of infected units are located in Mexico, France, and Italy, followed by the USA, Germany, Brazil, and Spain. Because the malware resides in the system partition, removal requires advanced technical intervention via ADB or a firmware reflash.
