# Midnight Mimosa Android firmware malware

> Live situation record from CLSTR: https://clstr.news/situations/midnight-mimosa-android-firmware-malware
> Updated: 2026-10-10T18:12:00.000Z. Sources: 32. Developments: 2.

Cybersecurity researchers at Bitdefender have identified a widespread malware campaign named ‘Midnight Mimosa’ that is preinstalled in the firmware of low-cost Android devices. The infection occurs at the manufacturing or supply chain level, targeting budget smartphones and counterfeits using MediaTek chipsets, including brands such as Doogee and Cubot.

Because the malicious code resides within the system partition, standard security measures like Google Play Protect can be bypassed, and factory resets may fail to remove the infection. The malware operates with high-level system privileges, allowing it to silently install or remove applications, grant permissions to SMS and accessibility services, and execute remote code. To evade detection, it uses names that mimic legitimate Android components, such as ‘com.android.system.lite’.

The campaign’s primary objectives include financial monetization through advertising fraud—using invisible overlays on legitimate apps to generate fraudulent ad clicks—and turning infected devices into residential proxies to mask cybercriminal activity. These devices can be utilized as part of massive botnets for DDoS attacks. The malware has reportedly affected thousands of devices across more than 150 countries.

Recent reports indicate a high concentration of affected devices in Mexico, France, Italy, the United States, Germany, Brazil, and Spain. Experts advise users who suspect an infection to avoid using the device for sensitive accounts and to seek replacements from established manufacturers.

## Claims

- Security researchers identified a malware campaign named Midnight Mimosa. (corroborated by 11 sources)
- Malware is used for ad fraud, building botnets, and acting as residential proxies. (corroborated by 11 sources)
- The campaign has affected thousands of devices across more than 150 countries. (corroborated by 10 sources)
- The malware operates with system-level privileges, allowing it to install or remove apps and grant itself permissions. (corroborated by 8 sources)
- The malware specifically targets budget Android smartphones utilizing MediaTek chipsets. (corroborated by 8 sources)
- The malware disguises itself using names like com.android.system.lite. (corroborated by 6 sources)
- A standard factory reset is insufficient to remove the infection. (corroborated by 5 sources)
- Affected devices were frequently detected in Mexico, France, Italy, the USA, Germany, Brazil, and Spain. (corroborated by 4 sources)
- Thirteen applications on Google Play were found to use the same ad fraud code and connect to the same control servers as the malware. (corroborated by 2 sources)

## Timeline

### 2026-10-10: Midnight Mimosa malware preinstalled in budget Android smartphone firmware

Bitdefender has identified Midnight Mimosa, a malware campaign preinstalled in the firmware of budget Android phones, enabling ad fraud and the creation of botnets across more than 150 countries.

12 sources. https://clstr.news/cluster/midnight-mimosa-malware-targets-budget-android-devices

### 2026-10-08: Midnight Mimosa malware found preinstalled on low-cost Android phones

Bitdefender has discovered Midnight Mimosa, a malware preinstalled in the firmware of low-cost Android phones, enabling ad fraud and proxyware activity across 150 countries.

20 sources. https://clstr.news/cluster/midnight-mimosa-malware-infects-low-cost-android-smartphones-via-firmware

---
Cite as: Midnight Mimosa Android firmware malware. CLSTR, https://clstr.news/situations/midnight-mimosa-android-firmware-malware