Bitdefender has found malware named Midnight Mimosa embedded in the firmware of low-cost Android phones sold in more than 150 countries. The malware is built into the device software, so users cannot uninstall it, and it runs with system privileges. The report was published on October 10 and 11.
Midnight Mimosa Is Embedded in Firmware With System Privileges
Because the code sits in firmware, it cannot be removed through normal means. Running with system privileges, it can silently install and remove apps, grant permissions and download remote code. Bitdefender links it to the Android.Joker, Phantom and Click malware families.
The campaign has run for roughly two years, beginning around 2024 by approximation. Bitdefender’s behavior-based detection flagged the malware even though signature-based checks came back clean.
Affected Devices: Doogee S200 X, Cubot KINGKONG X and Counterfeit Models
The affected phones are low-cost MediaTek-based devices. Named models are the Doogee S200 X and Cubot KINGKONG X, along with counterfeit handsets sold as the “i17 Pro Max,” “S25 Ultra” and “Note 18 Ultra.”
Package Names, Library and Command Channel
Indicators in the report include the package names com.android.sys.lite, com.android.sys.prot, com.android.sys.gmsprot and com.android.sys.bcprot, plus the library libeasy.so. Command and control runs over TCP port 6000.
Ad Fraud, Device Inventory and Residential-Proxy Botnet Use
The malware has several functions. It commits ad and click fraud through cover apps that present themselves as weather, app-lock or notes tools. It collects a device inventory. It also turns infected phones into residential-proxy botnet nodes, which can be used for DDoS attacks.
The combination means a single infected phone serves the operators in multiple ways: it generates fraudulent ad revenue, reports on what it is, and lends its internet connection to proxy traffic.
Infections Concentrated in Mexico, France and Italy
Midnight Mimosa has been seen in more than 150 countries. Mexico, France and Italy have the most detections. The United States, Germany, Brazil and Spain follow.
The report characterizes the impact as thousands of devices with unremovable malware, producing fraud and proxy abuse.
No Patch Cited for Doogee S200 X or Cubot KINGKONG X
No vendor patch was cited in the coverage. Bitdefender published its findings, but the reporting does not say whether Doogee, Cubot or the makers of the counterfeit handsets have responded or issued firmware updates. It also does not give an exact count of infected devices, describing them only as thousands.
The firmware-level placement is the feature that separates this case from malicious apps found in app stores. An app can be removed by a user, while code embedded in the system image persists and holds privileges that ordinary apps do not. The use of cover apps that look like weather, app-lock and notes tools adds a visible layer on top of the system-level components.
The report ties the malware to earlier Android families, Joker, Phantom and Click, which are associated with fraud and unwanted app installation. The residential-proxy function is a different kind of harm: the victim’s phone becomes a node whose traffic can be used by others, including for DDoS, without the owner’s knowledge.
How Bitdefender Spotted the Malware
Signature-based detection did not flag Midnight Mimosa. Bitdefender’s behavior-based detection did, by observing what the code does on the device rather than matching it against known samples. That detail helps explain how a campaign running for roughly two years stayed under the radar.
The behaviors observed match the capabilities listed in the report: silent installation and removal of apps, permission grants, and downloads of remote code under system privileges. The command channel uses TCP port 6000, and the library libeasy.so and the com.android.sys package names give analysts concrete artifacts to look for on suspect phones.
Coverage does not give a precise device count, saying only that thousands of devices are affected. The countries with the most detections are Mexico, France and Italy, followed by the United States, Germany, Brazil and Spain.
