Midnight Mimosa malware found in thousands of low-cost Android phones

Security researchers have uncovered a malware campaign known as ‘Midnight Mimosa’ affecting thousands of low-cost Android devices across more than 150 countries. The malware is pre-installed within the device firmware before reaching consumers, making it extremely difficult to remove through standard methods like factory resets or app uninstallation.

Bitdefender identified affected models including the Doogee S200 X and Cubot KINGKONG X, as well as various counterfeit devices. The campaign has reportedly been active for approximately two years. The malware can automatically install around 32 different applications disguised as legitimate tools, such as weather apps, file managers, and audio editors. These apps are used to commit advertising fraud by generating fake clicks and views, or to turn the device into a network traffic proxy.

Because the malicious code resides in the system partition or firmware, remediation may require a clean firmware update from the manufacturer or professional technical assistance. Notable regions with high infection rates include Mexico, France, Italy, the United States, Germany, Brazil, and Spain.