Bitdefender Finds Firmware Malware Preinstalled on Thousands of Budget Android Phones in 150+ Countries

A malware campaign baked into the firmware of cheap Android phones has hit thousands of devices in more than 150 countries over roughly two years, according to a report from the Romanian security firm Bitdefender, published Thursday, Oct. 8 and updated Oct. 9.

Bitdefender calls it Midnight Mimosa. The company says the malicious code is on the phone before the owner switches it on for the first time, and "it can't be uninstalled."

What the malware does

The core component is a system app, com.android.system.lite, that runs with system-level privileges. It can silently install and remove apps, grant itself permissions and download and run code supplied by its operators.

It goes by the label "System," has no icon and does not appear in the launcher. Bitdefender found the same core shipping under other system-sounding names, including com.android.sys.prot, com.android.sys.gmsprot and com.android.sys.bcprot. "The package name is not the threat," the researchers wrote. "The shared core underneath it is."

The malware rotates through at least 32 disguised apps: fake app-lockers, weather apps, file managers, OCR tools and audio editors. It also grants itself Accessibility, Notification Access and SMS permissions. Bitdefender said it did not see those last permissions used in practice, but they are available to the operators.

Before installing some payloads, it disables the Google Play Store and then turns it back on. Bitdefender did not state a purpose, but the maneuver appears aimed at slipping past Play Protect.

How it makes money

The system app does not click on ads itself. The disguised apps load real ads through a legitimate ad software kit, then hide them in an invisible window layered over other apps. The ad network registers views no human ever saw.

Bitdefender says the scheme is "likely designed mainly to generate revenue." The operators also collect device and installed-app information and turn phones into residential-proxy relay nodes. That lets others route internet traffic through a stranger's home connection and hide where it really comes from.

Botnet access has a second use. Bitdefender notes that access to botnets for DDoS attacks is "a hot commodity," and "the larger the botnet, the more money they can charge."

The company also found 13 apps on Google Play that talk to the same control servers. Those apps do real things, such as weather and QR-code scanning, but also show ads outside the app, including when the phone is not in use. None is currently available for download from the Play Store.

Which phones

The two most common infected models are the Doogee S200 X and the Cubot KINGKONG X. Both brands are Chinese. Bitdefender also found infections on phones impersonating Samsung and Apple products, with model strings such as "i17 Pro Max," "S25 Ultra" and "Note 18 Ultra." Some non-Samsung devices report the Galaxy S25 Ultra model code SM-S938B.

The affected phones are sold through mainstream online marketplaces. One device Bitdefender examined cost about $180.

The most detections were in Mexico, France and Italy, followed by the United States, Germany, Brazil and Spain.

Owners of Cubot and Doogee phones had already complained on the XDA forum about suspicious apps that kept reinstalling after removal. One Doogee Fire 3 Max owner said an official firmware update brought the infection, which went away when an older firmware was restored and returned when the update was reinstalled. Some users said later manufacturer updates fixed the problem. Neither Doogee nor Cubot has publicly explained how the malicious code reached its firmware. Bitdefender confirmed that one package named by forum users, com.android.non.szcz, belongs to the same malware family.

Who is responsible

That remains open. Bitdefender found some malware builds on devices whose firmware was signed with certificates attributed to Shenzhen Zediel Co., Ltd, a Chinese company that appears to make motherboards built around Rockchip processors. The report says how those certificates ended up on the phones, and "whether the certificate owner was involved in or aware of the malware deployment," is unclear.

Some builds carry different signing certificates altogether. Zediel did not immediately respond to a request for comment from PCMag. The malware is believed to have entered somewhere in the device supply chain, and no one has said at which stage the firmware was altered. Bitdefender has not named the operators.

Why cleanup is hard

Because the malware is signed and sits in the system partition, Android's normal uninstall process cannot remove it. Bitdefender found it only because its App Anomaly Detection flagged a supposed system component that kept switching on Accessibility and Notification Access and installing unrelated apps. With the app preinstalled, watching its behavior was the only way left to catch it, the researchers said.

TechRadar reported that cleanup often requires firmware-level remediation. In the Doogee Fire 3 Max case, restoring older firmware cleared the infection, though the infection returned with the next update.

The open questions are specific. Who inserted the code, whether Doogee, Cubot or Zediel knew, and how many phones are affected beyond the "thousands" Bitdefender counted are all unanswered. None of the manufacturers has yet addressed any of it.