Pre-installed Malware Discovered on Android Smartphones

Security experts from Bitdefender have discovered a new wave of attacks known as Midnight Mimosa. This affects low-cost Android smartphones that are shipped with pre-installed malware. The malware is integrated directly into the firmware of the devices, meaning that buyers receive a new smartphone with malicious software already installed. The malware has system privileges, allowing attackers to install apps unnoticed, commit ad fraud, and turn the devices into private proxies. Bitdefender identified around 32 applications that were distributed through the malware framework.

These applications are disguised as everyday tools, including weather apps, file managers, and audio editors. Researchers suspect that the malware was injected at some point in the supply chain of the devices. So far, it is unclear who is behind the attack and how exactly the malicious code made its way into the firmware. However, security researchers found firmware signed with certificates associated with the Chinese device manufacturer Shenzhen Zediel. Bitdefender clarifies that this association does not prove that Shenzhen Zediel authored or distributed the malware.

The malware particularly affects low-cost Android devices equipped with MediaTek chipsets. According to reports from Bleepingcomputer, devices masquerading as products from reputable manufacturers like Samsung and Apple are also affected. The campaign has impacted thousands of devices across more than 150 countries over a period of about two years. Most victims have been reported in countries such as Mexico, France, Italy, the United States, Germany, Brazil, and Spain. In Germany, users of smartphones from brands like Doogee and Cubot are particularly affected.

Owners of affected devices report suspicious applications that reinstall themselves after being uninstalled. A user of a Doogee Fire 3 Max reported that an official firmware update infected the device with malware. After restoring an older firmware version, the malware disappeared, but reappeared upon reinstalling the update. Some manufacturers have released firmware updates intended to resolve the issue. However, they have not publicly explained how the malware entered the affected firmware.

The uncertainty regarding the origin of the malware and the method of injection remains. For affected users, removing the malware proves to be difficult. The pre-installed malicious software has deeper system privileges, complicating complete uninstallation. Security researchers recommend resetting the devices to factory settings and manually reviewing all applications. The discovery of this malware campaign raises questions about the security of Android devices, especially in low-cost models.

The security situation could further deteriorate if no clear measures are taken to combat such attacks. Bitdefender researchers have documented the affected models and malware variants to warn users. The vulnerability affects devices sold in the last two years. The exact number of affected devices is still unclear, but thousands of infected smartphones are assumed. The malware is an example of the growing threats in mobile security.

Bitdefender has documented the affected models and malware variants to warn users. The security situation could further deteriorate if no clear measures are taken to combat such attacks. Researchers recommend regularly installing firmware updates and using security software to minimize the risk of infection. The malware campaign was published in a comprehensive analysis by Bitdefender on October 24, 2026.