You buy a budget Android phone for your kid or your mom, set it up, avoid sketchy downloads, and figure the cheap price was the low point of the deal. Bitdefender researchers published a report on October 8 that changes that math. They found malware called Midnight Mimosa living in the firmware of low-cost Android phones, and it was on the device before the owner ever pressed the power button.

What it does

The core is a system app. It ships platform-signed, runs as the system user, has no icon, and shows up disguised as an OS component with names like com.android.system.lite, com.android.sys.prot, and com.android.sys.gmsprot. Because it's part of the system partition, Android's normal uninstall can't touch it.

From that perch it quietly does three things:

  1. Silently installs and removes other apps. It has the INSTALL_PACKAGES permission as the system user, so installs happen with no prompt, no confirmation, nothing. Before each install it briefly disables the Play Store, where Google's Play Protect scanner lives, then re-enables the store afterward so nothing looks off. It even forges the app's install record to claim the app came from Google Play.
  2. Runs ad and click fraud. It drops cover apps that look like weather utilities, app lockers, note apps, and file managers. Those load real ads through legitimate ad networks, then an invisible layer registers impressions and clicks nobody made. The fraud code is tuned with daily caps and randomized touch placement so the traffic looks organic.
  3. Turns the phone into a relay node. A hidden component it installs (com.mobile.applock.en, labeled "Locket") enrolls the device with a command server and can pipe other people's traffic through the phone's internet connection. That's residential proxyware: some stranger's attacks or scraping now originate from your home connection. Researchers confirmed the proxy command server was live and accepting device registrations.

There's also a stored threat. Beyond the apps it actively installs, the enabler holds Android Accessibility, Notification Access, and SMS permissions: the same powers banking trojans use to read every screen and grab one-time codes. Bitdefender watched grants being turned on and off repeatedly but didn't see the powers used yet. They're available to the operator on demand, from a server the owner can't see, on a phone the owner can't clean.

How wide is it

Across roughly two years of telemetry: thousands of unique devices in more than 150 countries. Most victims are in Mexico, France, and Italy, with the United States, Germany, Brazil, and Spain close behind.

The hardware side is the messy part. The two biggest affected models are real, name-brand budget phones: the Doogee S200 X and the Cubot KINGKONG X. Beyond those, the campaign runs on cheap white-label MediaTek devices, including outright counterfeits. We're talking handsets reporting themselves as "S25 Ultra" or "i17 Pro Max" that are neither. Firmware on affected devices was signed with certificates tied to a Shenzhen manufacturer named Zediel, but Bitdefender is careful here: that's technical attribution, not proof the company wrote or knew about the malware. Whoever inserted it could be an ODM, a firmware integrator, or someone further down the distribution chain. Nobody knows yet.

And a factory reset does not fix it. The component sits in the system partition, so erasing user data leaves it in place. Bitdefender says cleanup requires a firmware-level fix or disabling the component over ADB. Neither is anything most families can or should attempt.

Two details make this worse than the usual malware story:

How to check a phone

None of these checks is perfect, but together they flag most of the risk:

Before you buy

The counterfeit angle is the giveaway of this whole campaign. These devices survive because nobody audits a $90 phone. Two rules that mostly eliminate the risk:

The honest summary

Your phone can be a malware node from the factory. Every user-facing defense on Android (the install prompt, the store review, Play Protect, the uninstall button) assumes you agreed to what's on the phone. Firmware malware skips all of it, including the factory reset you'd reach for first.

If a budget phone in your house is showing any of these signs, don't reset it and reuse it. Audit it with the checks above, or retire it. And if you want a second set of eyes, that's part of what I do: a phone and router audit that checks the device, reads your router's DNS logs for known-bad names, and tells you whether the device belongs on your network at all.

If someone you know just bought an $80 "S25 Ultra," send them this post before they log into their Google account on it.

Sources: Bitdefender Labs — "The phone was compromised before the user turned it on: the rise of Midnight Mimosa" (Oct 8, 2026), BleepingComputer coverage, Android Authority, Hive Security guidance, and the XDA forum thread from affected device owners.