Search
Apple HubAIPhones & PlansLaptops & PCsAudioCameras & Creator GearSmart HomeTVs & StreamingPrinters & Office
Home / Intelligence Briefs / Bitdefender finds Midnight Mimosa malware preinstalled on low-cost Android devices
TRENDINGSecurity

Bitdefender finds Midnight Mimosa malware preinstalled on low-cost Android devices

The October 8 researcher report, updated October 9, describes thousands of observed devices across more than 150 countries over roughly two years. Spoofed model names are not proof that genuine flagship phones are affected.

Key points

  • The October 8 researcher report, updated October 9, describes thousands of observed devices across more than 150 countries over roughly two years. Spoofed model names are not proof that genuine flagship phones are affected.

Bitdefender's October 8 research report, updated October 9, describes Midnight Mimosa, a malware campaign found preinstalled in the firmware of low-cost, multi-brand Android devices built on MediaTek platforms. The finding concerns affected devices in the researchers' investigation, not every Android phone or every phone using a MediaTek chip.

The researchers say the campaign was observed on thousands of unique devices across more than 150 countries over a roughly two-year window. Those figures describe the observed campaign over time. They are not a count of phones newly infected on October 12 or an estimate of the entire Android installed base.

The persistent system component can install and remove apps, grant permissions and load remotely supplied code without an ordinary user installation prompt. Bitdefender describes hidden ad and click fraud through cover apps, as well as residential-proxy relay activity. The report distinguishes permissions available to the operator from sensitive access actually seen being used during its analysis.

The report also identifies thirteen Google Play applications carrying the same ad-fraud code. These are a separate distribution path from the preinstalled system packages: the Play applications do not have the same system-level privileges. Their presence in the dated report is not a verified statement that all thirteen remain available in the store today.

Some affected devices report counterfeit flagship names or spoofed model codes. The researchers explicitly say those strings are spoofing indicators, not a real device inventory. Certificates bearing an OEM's name were found on some affected firmware, but the report does not establish whether the certificate owner knew of or participated in the deployment. It says the point of insertion in the supply chain remains unclear.

Limits: these are one security vendor's technical findings, not a finding that genuine Apple or Samsung flagships are infected or that any named manufacturer deliberately installed the malware. The preinstalled root component cannot be removed by an ordinary uninstall. The researchers say durable cleanup sits with the vendors and marketplaces supplying the affected firmware; this brief does not turn that finding into a guaranteed consumer repair procedure.

Primary sources