Midnight Mimosa malware preinstalled in firmware of cheap Android phones; fixes only from some makers
Bitdefender found Midnight Mimosa malware preinstalled in cheap MediaTek Android phones (Doogee, Cubot, fake-brand clones) in 150+ countries. It can silently install apps and use the phone as a proxy. Can't be uninstalled; check for a maker firmware update or replace the phone.
If you own a budget Android phone, especially a Doogee, Cubot or a lookalike of a famous brand, check for a firmware update from the maker and consider replacing a phone you can't verify. Don't use it for banking or sensitive accounts until it's confirmed clean.
- Android firmware containing com.android.system.liteno fixed version yet
What’s happening
Bitdefender Labs reported on 8 October 2026 that malware it calls Midnight Mimosa ships inside the firmware of low-cost Android phones built on MediaTek chips. Its main component is a system app disguised as an Android package, which can silently install and remove apps, grant itself permissions and run code downloaded from a remote server. Bitdefender says the operators appear to be after money from advertising fraud, click fraud and access to a residential-proxy network, which routes other people's internet traffic through infected phones. It was seen on thousands of devices in more than 150 countries over about two years, mostly in Mexico, France and Italy. Named models include the Doogee S200 X and Cubot KINGKONG X, plus counterfeit phones imitating Samsung and Apple flagships. Because it sits in the system partition, normal uninstalling does not remove it; cleanup needs a firmware fix or technical removal over ADB. Some manufacturers have released firmware updates that cleared infections, but one owner reported an official update reinstalled the malware. Nobody has explained how it got into the firmware, and Bitdefender says it could not confirm traffic forwarding in its tests. Thirteen Google Play apps carry related ad-fraud code.
- What
- Poisoned software
- Affects
- Low-cost Android phones on MediaTek chips (e.g. Doogee S200 X, Cubot KINGKONG X, counterfeit-brand phones)
- Affected
- Doogee S200 X
Cubot KINGKONG X
Doogee Fire 3 Max (reported by an owner)
Counterfeit phones imitating Samsung and Apple flagships
Low-cost MediaTek-based Android phones (board k62v1_64_bsp / MT6762 seen) - Fixed in
- No fix yet
- Since
- 8 Oct 2026
Timeline
- UpdatePartly fixed
Bitdefender updated its write-up (it notes an address first thought to be a control server was later found to be a sinkhole). It says no vendor, manufacturer or Shenzhen Zediel response is documented, and that normal uninstalling does not remove the malware.
- UpdatePartly fixed
BleepingComputer reported the findings, naming the Doogee S200 X and Cubot KINGKONG X plus phones imitating Samsung and Apple models. It said some manufacturers had released firmware updates that cleared infections, but none had explained how the malware got into the firmware, and one Doogee Fire 3 Max owner said an official update brought it back.
- Made publicNo fix yet
Bitdefender Labs published research on Midnight Mimosa, malware built into the firmware of low-cost, multi-brand Android phones on MediaTek chips. It was seen on thousands of devices in more than 150 countries over roughly two years.
Sources
- Midnight Mimosa malwareBitdefender Labs · 8 Oct 2026
- Low-cost Android phones ship with residential proxy malwareBleepingComputer · 8 Oct 2026